MALICIOUS — kavijaxefenipes.pdf

MALICIOUS — kavijaxefenipes.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 5ee62ce8a70ed3890b83b662f647a3c49dbe86f3afe6509d655d756f50675162
• SHA-1: 97b57d205636b543c4e82a014b88921d75e7ba2c
• MD5: 5ae35dd8890904d3a30abd9e987b4361
• ssdeep: 3072:7L1CPLft9KRJqeh/31+ZfUnM2liJ1JPRLAN8jx+DWUgRo:0DHIl531+ZfUnMVFLnO
• TLSH: T10B3CD0F3629BDD5C72CF9F43A9EA017D604BDA983121DB8041882A6CC57C9BC7F145A2
• Submitted as: kavijaxefenipes.pdf
• File type: pdf · Size: 118466 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d07ea83a9d---pabizusalobajixowudiwut.pdf, http://www.xpresswedding.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609223aa43581---76116313336.pdf, https://estigotours.com/wp-content/plugins/super-forms/uploads/php/files/3fc741dec6057b75bfb6a0bc10fdbb6b/42092923197.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=botim+apk+hack
• https://www.sharpeningfactory.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d07ea83a9d---pabizusalobajixowudiwut.pdf
• http://www.xpresswedding.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609223aa43581---76116313336.pdf
• https://estigotours.com/wp-content/plugins/super-forms/uploads/php/files/3fc741dec6057b75bfb6a0bc10fdbb6b/42092923197.pdf
• https://veritiesinstitute.com/wp-content/plugins/super-forms/uploads/php/files/8091a80935b2fb0163734e695414c505/20216448556.pdf
• http://seanmore.com/userData/board/file/79512788070.pdf
• http://iamsoldierfit.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609de5c767b55---rarav.pdf
• http://www.meglobalinc.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160779ee99be0d---25729788765.pdf
• https://arihantgranites.in/wp-content/plugins/super-forms/uploads/php/files/ftcd0ks05evvf7h1f321ljgu05/87227435173.pdf
• https://pass-eco-energies.com/ckfinder/userfiles/files/dakajawuvimonalazezeg.pdf
• https://auditorescr.com/ckfinder/userfiles/files/84340830732.pdf
• https://bokseinstituttet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160923f2f23ea2---memeriwegunotabojunidefez.pdf
• https://holzhaus-suedtirol.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607bb33ac05c7---60173588159.pdf
• http://cuatudongbinhduong.net/uploads/files/disaxu.pdf
• http://allseasonsbanquet.com/clients/868236/File/likowetamexonofujufad.pdf
• http://kapelski.pl/userfiles/file/41506102285.pdf
• http://pvsystexperts.com/wp-content/plugins/super-forms/uploads/php/files/mkvg3g30hn8opqin6va1a6s7e7/40719316407.pdf
• http://ducthoaudio.com/upload/files/51047088875.pdf
• http://trungtamdaykem.vn/Images_upload/files/2423586466.pdf
• https://www.grandiosa.is/wp-content/plugins/super-forms/uploads/php/files/p9vvrunji86n16sv6117cb8ec5/87623216335.pdf
• https://floorco.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/5dcb01828847020f2c300ea23fc7b1df/lanafedixonanapibesubexuz.pdf
• https://yuktiedu.com/wp-content/plugins/super-forms/uploads/php/files/32dbc732a22dd2ef2c044e3c40093317/posej.pdf
• http://www.mondzorgvesa-voorschoten.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16076bbf9f20cc---fuponejijusogobiwuwekazil.pdf
• http://mazurubezpieczenia.pl/zdjecia/fck/file/nedefikumigazetu.pdf
• http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a7535da73e9---pivevewoluvipasamelep.pdf

Embedded domains

• feedproxy.google.com
• www.sharpeningfactory.com
• www.xpresswedding.com
• estigotours.com
• veritiesinstitute.com
• seanmore.com
• iamsoldierfit.com
• www.meglobalinc.co.za
• arihantgranites.in
• pass-eco-energies.com
• auditorescr.com
• holzhaus-suedtirol.it
• cuatudongbinhduong.net
• allseasonsbanquet.com
• kapelski.pl
• pvsystexperts.com
• ducthoaudio.com
• floorco.allianceflooring.net
• yuktiedu.com
• www.mondzorgvesa-voorschoten.nl
• mazurubezpieczenia.pl
• artmetinc.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report