MALICIOUS — temawoxonuwisugajo.pdf

MALICIOUS — temawoxonuwisugajo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 62520451d2a7b7c6e560423525891f8b1d9738daae7f01d2c86570441239ef09
• SHA-1: 54948eb98396550e41a6aae009f1a0dbc3a55fd2
• MD5: fc3a9de1dd4bc26faaa3ca3f73c9f068
• ssdeep: 1536:tnLXgm9qrypCrZQDT7fJZ5u2p6jg3L0iLAsWapOtQHWtGg7+rpcU:ZXgd+mZmfJHu2pV3tLAdtQfw+rh
• TLSH: T17B37C0F320DBDD9C7B876B5369AA21ADA085D7887162EBD0808C776CD47C9BDBE10500
• Submitted as: temawoxonuwisugajo.pdf
• File type: pdf · Size: 75769 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://www.medipratik.com/wp-content/plugins/formcraft/file-upload/server/content/files/161351c8265f5e---80446783743.pdf, http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1612f46755a641---vavur.pdf, https://regalcabs.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1612edfabb4608---zevawafe.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=5+letter+words+starting+with+ke
• https://www.medipratik.com/wp-content/plugins/formcraft/file-upload/server/content/files/161351c8265f5e---80446783743.pdf
• http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1612f46755a641---vavur.pdf
• https://regalcabs.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1612edfabb4608---zevawafe.pdf
• http://webcertain.net/contentupload/fckeditorUploads/organization_/file/42647108602.pdf
• http://gamax-moto.cz/data/dokumenty/zedasupodise.pdf
• https://zweefvlieg.net/userfiles/file/74373347884.pdf
• http://tianlanlawyer.com/filespath/files/20210902092128.pdf
• http://vinabomi.com/uploads/userfiles/file/jowedonem.pdf
• http://qqwandai.com/uploadfile/file/gevokidalegopaxisumejo.pdf
• http://wsmr.us/userfiles/file/bamazuxilagixofuwineset.pdf
• https://felicitareonline.ro/ckfinder/userfiles/files/pewoxijo.pdf
• http://phuketdriveschool.com/userfiles/file/soratuv.pdf
• http://hai-bi.com/uploads/files/202109020817331696.pdf
• https://robustbrakes.com/administrator/imagetemp/file/vagirinoz.pdf
• http://dabien.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/161375255b706a---loxupadarijaxutedizetitux.pdf
• http://fkm-lux.by/var/upload/file/likenubitalowexaro.pdf
• http://dragonspond.com/uploads/files/27795079490.pdf
• https://elpollopaulino.com/cenavarra_userfiles/files/gerarapoxinex.pdf
• http://jd6618.com/jd6618/file/2021-9/file/LwpCms2021_09_02_21_19_52_5955.pdf
• http://massimobertoarchitetto.com/userfiles/files/jenajesewifa.pdf
• https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/rlvj58ct84napsuvelkm5gbffg/nepugejibaguz.pdf
• http://www.libroparlatolions.it/backoffice/ckfinder/userfiles/files/99998018321.pdf
• http://yangs-ns.com/ckfinder/userfiles/files/20210904020013.pdf
• https://taxforce.nl/userfiles/files/81903518482.pdf

Embedded domains

• feedproxy.google.com
• www.medipratik.com
• zadonskiy.ru
• regalcabs.co.uk
• webcertain.net
• zweefvlieg.net
• tianlanlawyer.com
• vinabomi.com
• qqwandai.com
• wsmr.us
• phuketdriveschool.com
• hai-bi.com
• robustbrakes.com
• dabien.co.kr
• dragonspond.com
• elpollopaulino.com
• jd6618.com
• massimobertoarchitetto.com
• www.libroparlatolions.it
• yangs-ns.com
• taxforce.nl
• dkkarsin.pl
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report