MALICIOUS — xefuruxubapebowajaferegi.pdf

MALICIOUS — xefuruxubapebowajaferegi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 37ce2a0c81eed80dbbce855953ef897c49f2b67d861e284c2754dbd52550f3a2
• SHA-1: 2000b6fb947267bd2dd34e4c9ff1ccd46c53d608
• MD5: 877199868240ccf84af4d62ad7149697
• ssdeep: 1536:QPm6PL/Q6TWhagarEWd4msMpGwtFxQw25pWGpOK0T3aBWi1IXKHVBFWSqhWU+NcN:7izBOaJ/WRIFx525eK0Tq3cc7ir+NM
• TLSH: T1F739CFF31057DE5CA74BAB43A5AA20A9748BD2C92532F7844088B76DC87CA7D7F11910
• Submitted as: xefuruxubapebowajaferegi.pdf
• File type: pdf · Size: 91397 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://wastran.ru/uplcv?utm_term=meaning+of+excavated+in+english, http://optikametuje.cz/userfiles/file/14612228103.pdf, http://lotuscourtpune.com/wp-content/plugins/super-forms/uploads/php/files/ardpv3c2fstd3e55426rsksa80/lobazufagozozewu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://wastran.ru/uplcv?utm_term=meaning+of+excavated+in+english
• http://optikametuje.cz/userfiles/file/14612228103.pdf
• http://lotuscourtpune.com/wp-content/plugins/super-forms/uploads/php/files/ardpv3c2fstd3e55426rsksa80/lobazufagozozewu.pdf
• http://lhsclassof77.com/clients/34792/File/92128582297.pdf
• https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/160b95d2617690---kesudupafoforaliwiwakotir.pdf
• https://christembassyromford.org/wp-content/plugins/super-forms/uploads/php/files/13b0d681da6629f5a0c9893a577d4136/kajonogu.pdf
• https://studiogreenwich.ru/wp-content/plugins/super-forms/uploads/php/files/9d6f1dcc7f5ca51a59644ff0c93ab625/gobujafibixo.pdf
• https://www.businesswatchguardingservices.co.uk/wp-content/plugins/super-forms/uploads/php/files/5v8o79i8h1cda4200b6uhgtjsl/suletigarafesivon.pdf
• https://vieclambanhang247.com/upload/files/75487335501.pdf
• http://yatros.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160a688903b360---vofasetagilodevixagi.pdf
• https://dichvumayphoto.vn/webroot/img/files/radebuwugolupomezudifuri.pdf
• http://www.colegiometa.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/160cfc7ff8cb80---27436682989.pdf
• http://intrinhgia.com/admin/webroot/upload/image/files/63378482846.pdf
• https://humantouchtranslations.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/160b0428ea1e84---53192569404.pdf
• http://call.ae/wp-content/plugins/formcraft/file-upload/server/content/files/160863141d2f24---82551395446.pdf
• https://theemperorsoldclothes.co.uk/wp-content/plugins/super-forms/uploads/php/files/auni0guqh64hqttng021hg4i20/vebibonedoragumapefu.pdf
• http://beijingxinzhi.com/userfiles/file/20210616124323_1796664102.pdf
• http://fedime.org/imagenes/35181004667.pdf
• https://mindweave.co.uk/wp-content/plugins/super-forms/uploads/php/files/9u63hrhm5kq31nr28gtra75p08/82260595294.pdf
• https://teplitsyoptom.ru/wp-content/plugins/super-forms/uploads/php/files/72ae9f210536dbbabbcc370638094572/kativejezubojogaj.pdf
• https://www.numberoneporthill.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606c89a2358e1---93669755869.pdf
• https://solidpractise.com/files/userfiles/file/junupokemekakitiruwejama.pdf
• https://slavica.ru/wp-content/plugins/super-forms/uploads/php/files/e20d323cbfd4a4a3ba48de325521def8/78147852716.pdf
• https://razvozka24.ru/wp-content/plugins/super-forms/uploads/php/files/b94f157e3bbbad8584fb679b7f87c196/vujosoboxuvu.pdf
• http://kennyre.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4332c6deed---xovunebima.pdf

Embedded domains

• wastran.ru
• lotuscourtpune.com
• lhsclassof77.com
• christembassyromford.org
• studiogreenwich.ru
• www.businesswatchguardingservices.co.uk
• vieclambanhang247.com
• www.colegiometa.net
• intrinhgia.com
• humantouchtranslations.com
• theemperorsoldclothes.co.uk
• beijingxinzhi.com
• fedime.org
• mindweave.co.uk
• teplitsyoptom.ru
• www.numberoneporthill.co.uk
• solidpractise.com
• slavica.ru
• razvozka24.ru
• kennyre.com
• www.w3.org
• purl.org
• ns.adobe.com
• optikametuje.cz
• rescue.bg

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report