MALICIOUS — runepumulivedil.pdf

MALICIOUS — runepumulivedil.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 3cf65f1d580b1959175ee6b235dafc7524c8cbe4d572058a2555cdf599bee735
• SHA-1: 87ff351b2fcc8f66ad422be9e339323fdb02c900
• MD5: 58c81ee187fe7fa1788878f96cbf8c6f
• ssdeep: 1536:bfVpSKF2J5QPDulcZIi/MPZz9wJbsgs8HhEDVFVR7+fSpc4tS6+Ef:jVpSegCulcZIi/Mxz8sgsumVB7fc2S6Z
• TLSH: T1E638E1F3B44BDDCCBB851B4365B72858648EC7991161ABA0D48C79ACC57C2BE3E20B10
• Submitted as: runepumulivedil.pdf
• File type: pdf · Size: 79426 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafffe.ru/wb?keyword=dominos%20order%20online, https://uploads.strikinglycdn.com/files/3e63c723-b397-47de-9047-b0c80ea8ff5b/ca_co_cu.pdf, https://bolewotimeri.weebly.com/uploads/1/3/4/6/134689798/xowamobujomudig.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafffe.ru/wb?keyword=dominos%20order%20online
• https://uploads.strikinglycdn.com/files/3e63c723-b397-47de-9047-b0c80ea8ff5b/ca_co_cu.pdf
• https://s3.amazonaws.com/luresimosip/omron_bp_monitor_hem_711_manual.pdf
• https://bolewotimeri.weebly.com/uploads/1/3/4/6/134689798/xowamobujomudig.pdf
• https://uploads.strikinglycdn.com/files/ec948436-00f9-4314-b8b9-ab80ff8742d2/dapafinagud.pdf
• https://uploads.strikinglycdn.com/files/32d7b42e-fa10-4ef1-9b75-c3a9690b5eb3/damibogelevadumalegaf.pdf
• https://jasazifo.weebly.com/uploads/1/3/1/4/131437377/fugevo-tufuwepu.pdf
• https://s3.amazonaws.com/wulagisi/50731855141.pdf
• https://s3.amazonaws.com/vonusirukete/thomas_dale_high_school_bell_schedule.pdf
• https://s3.amazonaws.com/napisakaluja/93424335280.pdf
• https://zejuwotozago.weebly.com/uploads/1/3/4/6/134647352/wibefomu-suvefemosujig-joxavamevu.pdf
• https://xonuveviriniw.weebly.com/uploads/1/3/0/7/130738603/e850990e.pdf
• https://s3.amazonaws.com/dadupawo/acting_career_101.pdf
• https://s3.amazonaws.com/rebomedug/the_seven_deadly_sins_season_4_netflix_release_date.pdf
• https://uploads.strikinglycdn.com/files/b89e9828-6665-4c57-8b17-dc5e4c0ee7dd/mofevo.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffe.ru
• uploads.strikinglycdn.com
• s3.amazonaws.com
• bolewotimeri.weebly.com
• jasazifo.weebly.com
• zejuwotozago.weebly.com
• xonuveviriniw.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report