MALICIOUS — vanamuwetu.pdf

MALICIOUS — vanamuwetu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 59b1d3d5251d19ac7a7e47d0277f213df3078b6484e9eb762e4d77edcad54759
• SHA-1: 2cee39e97aa12fc8eed2bbedbd26a9c681d408b1
• MD5: f0bb41146e0bc12bda5ba7e9becfe28e
• ssdeep: 1536:f4HY8gwGDlCYjHwrK1ruGyv0rbb5SWeXujm616aj3iqbWQpOC7g5:GEwYjHwm8GyvObbuymM6aj3iqGCS
• TLSH: T15A38DFF32297CD4CB68F9F432BF712686089D3C87222AB901584765C847C6BEBF18951
• Submitted as: vanamuwetu.pdf
• File type: pdf · Size: 82002 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://jamisonfurnace.ca/userfiles/files/45000285532.pdf, http://chrislahoda.ca/userfiles/file/57977713888.pdf, https://aprilboya.com/userfiles/file/51841014335.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=adobe+pdf+download+gratis+em+portugues
• https://jamisonfurnace.ca/userfiles/files/45000285532.pdf
• http://chrislahoda.ca/userfiles/file/57977713888.pdf
• https://aprilboya.com/userfiles/file/51841014335.pdf
• https://jiu-hang.com/upfiles/editor/files/dexufawidasodutuzaludik.pdf
• http://gzmzwl.com/Uploadfiles/files/64217962485.pdf
• http://thevalleytrader.com/files/67847885781.pdf
• https://nhahangphongcanh.com/uploads/files/vutarigilebamobetej.pdf
• https://www.winsum.frl/ckfinder/userfiles/files/29732289185.pdf
• http://shijijiaming.net/filespath/files/20210906035121.pdf
• https://korovin.org/site/img_ufiles/28092070977.pdf
• https://jgranit.pl/userfiles/file/gozef.pdf
• http://dichvugiayphep.biz/upload/ck/files/32974197855.pdf
• http://ekhoron21.mn/uploads/files/jezavuwiset.pdf
• https://xn--bankkrtya-41a.hu/js/ckfinder/userfiles/files/5574445823.pdf
• http://phunggia.biz/userfiles/file/51035542615.pdf
• http://martom24.pl/martom/userfiles/file/zujowewiko.pdf
• http://mega-treid.com/userfiles/files/ramawegedofenevutu.pdf
• http://vetusmeter.com/images/upload/File/jivij.pdf
• http://all-premium.com/user_file/files/911122232.pdf
• http://maurovalleferroarchitetto.eu/userfiles/files/46119617725.pdf
• http://gold-carsales.com/js/upload/files/29434272068.pdf
• http://cafesezony.ru/fck_editor_files/files/61377995789.pdf
• http://kingspec.su/wp-content/plugins/super-forms/uploads/php/files/rcenb394j3terohtgid6oaghpk/sigefuzujanesurusezev.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• feedproxy.google.com
• jamisonfurnace.ca
• chrislahoda.ca
• aprilboya.com
• jiu-hang.com
• gzmzwl.com
• thevalleytrader.com
• nhahangphongcanh.com
• shijijiaming.net
• korovin.org
• jgranit.pl
• dichvugiayphep.biz
• phunggia.biz
• martom24.pl
• mega-treid.com
• vetusmeter.com
• all-premium.com
• maurovalleferroarchitetto.eu
• gold-carsales.com
• cafesezony.ru
• kingspec.su
• www.w3.org
• purl.org
• ns.adobe.com
• www.winsum.frl

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report