MALICIOUS — rujotav.pdf
MALICIOUS — rujotav.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
5d75291dee674b94696bcec831ee1d14428f4a2c808a4e5fa2672bed6e5f9637 - SHA-1:
2ad83950b671d0d54fe23889e9cd03b1385fdf28 - MD5:
f6ab94723ba72d32a3348660a3b56a7a - ssdeep:
3072:iOV/V6EzfDuS+Xr1xPWe1F9vTNBIuDkIrpMry78bWENR0:icsEzfiRr1pnZfICdpTT - TLSH:
T1153AD0F360A3CD8C7A5B6F4369EB01A8B09EE7446172D7A10489BB6C90BC53DBF04551 - Submitted as: rujotav.pdf
- File type: pdf · Size: 101620 bytes
- Verdict: malicious (96/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://adirondackseafood.com/ckfinder/userfiles/files/wirafezejixabe.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://synerhu.ru/uplcv?utm_term=what+are+my+learning+strengths, https://gencshoworganizasyon.com/upload/ckfinder/files/mewopozajudagulabupetofop.pdf, http://elskup.pl/images/assets/file/lugufejoderepemuwi.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://synerhu.ru/uplcv?utm_term=what+are+my+learning+strengths
- https://gencshoworganizasyon.com/upload/ckfinder/files/mewopozajudagulabupetofop.pdf
- http://elskup.pl/images/assets/file/lugufejoderepemuwi.pdf
- https://pellevah.com/upload/files/lupelebugedimakibepijepu.pdf
- https://globalazeri.az/wp-content/plugins/super-forms/uploads/php/files/mg4bjp22dtq4ollnq2qml51e62/64701161618.pdf
- https://inlandautorepairmurrietaca.com/wp-content/plugins/super-forms/uploads/php/files/05d3836488384b0c0e0937a45eb8b028/40803036895.pdf
- http://dobraukraina.org/sites/all/sites/dobraukraina.org/files/28667272980.pdf
- http://adirondackseafood.com/ckfinder/userfiles/files/wirafezejixabe.pdf
- https://tamtam.com.ua/wp-content/plugins/super-forms/uploads/php/files/5e53d67468480c45e18d10c3b1dc2601/16072194023.pdf
- https://drrajanmahtani.com/userfiles/files/ripatofibigipa.pdf
- http://quickvideo.nl/userfiles/file/89525714680.pdf
- https://mosoptagro.ru/wp-content/plugins/super-forms/uploads/php/files/8566c42d13fd9bf0b74fa678283b2a00/rabakazanowibomezumik.pdf
- http://aep-tc.com/cache/fck_files/file/nodukenamijifaparifepovu.pdf
- https://e-lightingcontrols.com/wp-content/plugins/super-forms/uploads/php/files/51968f9d51bde7d384ec606e3fb0c346/madisef.pdf
- https://romalasergroup.com/userfiles/files/9335281888.pdf
- https://www.ltgpartners.com/wp-content/plugins/super-forms/uploads/php/files/d34fe198a4e920203a1e82e53db9fba2/jugiborafuto.pdf
- https://kaktutzhit.by/uploads/files/98769872696.pdf
- https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/3da20576facbf9e60385af592ebd527c/79671350643.pdf
- https://neavocats.com/wp-content/plugins/super-forms/uploads/php/files/f9e6700f4b5e2b5caa158137047406eb/janemebuvopituseburesar.pdf
- http://www.insurancedirectcanada.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609258dcbee35---felime.pdf
- https://ludifrance.fr/userfiles/file/zasuzixipixekeguluzuf.pdf
- http://www.medical-psychology.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160a7b2700ecc3---ginujesasegofate.pdf
- https://www.reflectionuk.com/wp-content/plugins/super-forms/uploads/php/files/mjontvuh7kf29hit0gi6o2445n/5146657189.pdf
- https://olterus.com/contents//files/80293728110.pdf
- http://foire-fromages-et-vins.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8f5876682---35910758714.pdf
Embedded domains
- synerhu.ru
- gencshoworganizasyon.com
- elskup.pl
- pellevah.com
- inlandautorepairmurrietaca.com
- dobraukraina.org
- adirondackseafood.com
- tamtam.com.ua
- drrajanmahtani.com
- quickvideo.nl
- mosoptagro.ru
- aep-tc.com
- e-lightingcontrols.com
- romalasergroup.com
- www.ltgpartners.com
- 3dreamstudios.com
- neavocats.com
- www.insurancedirectcanada.ca
- ludifrance.fr
- www.reflectionuk.com
- olterus.com
- foire-fromages-et-vins.com
- www.adler-leitishofen.de
- learningkey.org
- www.w3.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report