MALICIOUS — mofewowotijub.pdf

MALICIOUS — mofewowotijub.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

SHA-256: 5e7243b68a98be2376e5d1e329e4bfb2391dbdd758cc9880877f012ae66af4f9
SHA-1: 20589c885a94a0da9ecccc60bfc82b37c879cc96
MD5: ec8916726ad64deae98fd871bf7eb5ff
ssdeep: 1536:XIyI2IVITKkFEod57tWZ22Pp/spIcHivWzNS4SuUw8/TWspOR3QW:nI2ImfEoE26spVCuA/yR9
TLSH: T15637BFF32097DD8CB78ACF0355EA119CE19AEB886172DE605488BBACC57C97E3B00550
Submitted as: mofewowotijub.pdf
File type: pdf · Size: 70061 bytes
Verdict: malicious (92/100)

Detections (4 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: https://archism.ru/uplcv?utm_term=reading+engagement+inventory, https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/16147dcc005687---90270270266.pdf, http://pomelieagency.com/userfiles/files/zolutizidozeboxarabofekis.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://archism.ru/uplcv?utm_term=reading+engagement+inventory
https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/16147dcc005687---90270270266.pdf
http://pomelieagency.com/userfiles/files/zolutizidozeboxarabofekis.pdf
http://daeryuhealthcare.com/ckupload/files/38475850551.pdf
http://masterref.ru/editorfiles/file/rirakuwobifa.pdf
https://stvorki.ru/files/file/55306876935.pdf
http://cn-biyoute.com/d/files/nupalororese.pdf
http://metall-press.ru/files/40445452652.pdf
https://barrier.exma.cl/ckfinder/userfiles/files/wisowodona.pdf
http://stevis.cz/files/file/22537661420.pdf
http://w-f-l.de/user_img/file/20855774583.pdf
http://cetis156.neutronds.com/assets/js/ckfinder/userfiles/files/teligopureb.pdf
http://mackits.eu/image/23600005367.pdf
http://hefei.chinatupai.com/web/js/ckfinder/userfiles/files/57636147352.pdf
http://waetsukai.jp/system/ckfinder/userfiles/files/89385351587.pdf
https://bodykneadstherapy.com.au/ckfinder/userfiles/files/4361396463.pdf
http://superlitefan.com/uploads/files/furevizanodenaserozox.pdf
https://yaofangpeixun.com/upload/files/lugomerabesurejisol.pdf
https://agrotehholding.ru/wp-content/plugins/super-forms/uploads/php/files/57bad17a3f52149b99a3cc165336559a/54820757665.pdf
http://isleford.com/filespath/files/20211001000810.pdf
https://acp-luxusingatlanok.hu/ckfinder/userfiles/files/tuvaselapitepafanapofa.pdf
http://piotrkowska77.pl/zdjeciafile/92766998356.pdf
http://queuemanagementsystems.com/wp-content/plugins/formcraft/file-upload/server/content/files/161303e9134d74---17385130150.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/

Embedded domains

archism.ru
www.colegiodesafio.net
pomelieagency.com
daeryuhealthcare.com
masterref.ru
stvorki.ru
cn-biyoute.com
metall-press.ru
w-f-l.de
cetis156.neutronds.com
mackits.eu
hefei.chinatupai.com
waetsukai.jp
bodykneadstherapy.com.au
superlitefan.com
yaofangpeixun.com
agrotehholding.ru
isleford.com
piotrkowska77.pl
queuemanagementsystems.com
www.w3.org
purl.org
ns.adobe.com
barrier.exma.cl
stevis.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report