MALICIOUS — zibuduvawumiwitusop.pdf
MALICIOUS — zibuduvawumiwitusop.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
38533ef4b8127fa7a2fae67172ce8882bd61d4b941933a54e58c5a7143fc3e8a - SHA-1:
84f6c6c5c2a492f8657706cd80c0638efd4c1a5a - MD5:
deb3341869d921bfd1610c193457151c - ssdeep:
1536:saK4lAqsbAl/WCpXRDUt4eja99D9gBVKKQTFOoUx99rblNYu:nZDLeja99D9gS3TWNblP - TLSH:
T14236D0F3218BDD4CBF9B67075EA601643889C6887131BFA4009CB76DC8BC2AF6D02651 - Submitted as: zibuduvawumiwitusop.pdf
- File type: pdf · Size: 69483 bytes
- Verdict: malicious (92/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://traffine.ru/wb?keyword=car%20game%20mod%20apk%20unlimited%20money, https://uploads.strikinglycdn.com/files/52bee005-ff24-41f8-b3dc-5c4fcb4685fb/retewefujixiro.pdf, https://cdn-cms.f-static.net/uploads/4369633/normal_5f87ec3fa5caf.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://traffine.ru/wb?keyword=car%20game%20mod%20apk%20unlimited%20money
- https://uploads.strikinglycdn.com/files/52bee005-ff24-41f8-b3dc-5c4fcb4685fb/retewefujixiro.pdf
- https://cdn-cms.f-static.net/uploads/4369633/normal_5f87ec3fa5caf.pdf
- https://cdn-cms.f-static.net/uploads/4373776/normal_5faa7c5fea2d3.pdf
- https://s3.amazonaws.com/jiwisigetizoxif/drift_hunters_unblocked_full_screen.pdf
- https://s3.amazonaws.com/metubevozisul/62925763763.pdf
- https://cdn-cms.f-static.net/uploads/4382003/normal_5fa783844a5ae.pdf
- https://uploads.strikinglycdn.com/files/5ea257e4-cfa0-4089-a23b-a3451fbd8aeb/99284900984.pdf
- https://bitujidup.weebly.com/uploads/1/3/4/5/134598072/rirumosopoliduvejup.pdf
- https://cdn-cms.f-static.net/uploads/4416664/normal_5f951f625c11e.pdf
- https://uploads.strikinglycdn.com/files/ecf0fc3a-0187-402a-8257-26434a004e18/labavefufopo.pdf
- https://cdn-cms.f-static.net/uploads/4368996/normal_5f94f3a52b007.pdf
- https://cdn-cms.f-static.net/uploads/4408586/normal_5fa4312f7de12.pdf
- https://s3.amazonaws.com/rizezobabub/lafexegu.pdf
- https://cdn-cms.f-static.net/uploads/4370073/normal_5fa1c3b56eb50.pdf
- https://uploads.strikinglycdn.com/files/354fc359-2cf4-46bf-9a5b-9ec272531b14/for_cause_and_comrades_sparknotes.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- traffine.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- s3.amazonaws.com
- bitujidup.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report