MALICIOUS — surijofotetafekajum.pdf

MALICIOUS — surijofotetafekajum.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 3e67578642f92909ee7f28980e60367fa11f29bfd59e2d0eb5aa36cd689f2fcb
• SHA-1: 5de7d34aac226c1a2e5664c15debdcb318c90786
• MD5: 082b3f551dcd7cd69217d0da39be3c6a
• ssdeep: 1536:Hr6TGqWXlfOtzMosc2ZfzfubIDmnicHWCpOViuI7KYaVWa/SR2YxPs9:wGZ8sZ7fJmaViuGKYaC2Yxu
• TLSH: T18E38C0F36167DC0CF6599F836A9B01ACA0C5E7481232FA9040C8776D9A7C4BEBF54852
• Submitted as: surijofotetafekajum.pdf
• File type: pdf · Size: 82851 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://logiccpacma.com/ckfinder/userfiles/files/20660549921.pdf, https://justforjetscatering.com/userfiles/image/files/bodig.pdf, https://huaku3c.tw/uploads/files/202109011648433390.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/Om9ozkHLxGw/uplcv?utm_term=notice+and+note+signposts+quiz+pdf
• http://logiccpacma.com/ckfinder/userfiles/files/20660549921.pdf
• https://justforjetscatering.com/userfiles/image/files/bodig.pdf
• https://huaku3c.tw/uploads/files/202109011648433390.pdf
• http://live-lessons.net/lcj/web/uploads/assets/file/38144220047.pdf
• http://aliguoriarchitetto.eu/userfiles/files/34852682555.pdf
• http://autosoftware.company/autoresponders_images/files/vexulujenidirab.pdf
• http://thessalonikiflights.com/files/files/wubixinanuwujob.pdf
• https://soportedevida.mx/ckfinder/userfiles/files/fuwakelavujolas.pdf
• http://parcroyale.hk/userfiles/kosigebowireba.pdf
• https://www.sexualaufklaerung-schule.ch/ck/ckfinder/userfiles/files/76741366207.pdf
• https://digitaluzaktanegitim.com/calisma2/files/uploads/tuvokuvipakirunugegid.pdf
• http://niszczeniewaw.pl/userfiles/file/40019867669.pdf
• http://vasilii-orlov.fun/wp-content/plugins/super-forms/uploads/php/files/9b70ac08444d71e5e3de1ea864f8d8eb/xukutizidu.pdf
• http://slsnn.ru/content/files/lukoribobujuzogimiwux.pdf
• http://af.ssla.ru/images/fornews/files/17347712226.pdf
• http://linza-market.ru/upload/files/jufefijekupuxelemel.pdf
• http://modnyi-buket.ru/uploads/files/gitufivakawes.pdf
• http://coyada.com/up_images/up_images/92542451343.pdf
• http://naturalfurnish.com/userfiles/file/21958157159.pdf
• http://chiangmai-esc.net/user_img/files/31207048139.pdf
• https://sunrise-photon.com/upfiles/editor/files/21950217783.pdf
• http://citescolairedeledit.com/include/file/midafowoniji.pdf
• http://medizator.ru/ckfinder/userfiles/files/77243281200.pdf
• https://jungleflightchiangmai.com/Uploads/files/22408115817.pdf

Embedded domains

• feedproxy.google.com
• logiccpacma.com
• justforjetscatering.com
• huaku3c.tw
• live-lessons.net
• aliguoriarchitetto.eu
• thessalonikiflights.com
• soportedevida.mx
• parcroyale.hk
• www.sexualaufklaerung-schule.ch
• digitaluzaktanegitim.com
• niszczeniewaw.pl
• vasilii-orlov.fun
• slsnn.ru
• af.ssla.ru
• linza-market.ru
• modnyi-buket.ru
• coyada.com
• naturalfurnish.com
• chiangmai-esc.net
• sunrise-photon.com
• citescolairedeledit.com
• medizator.ru
• jungleflightchiangmai.com
• inbeeldt.nl

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report