MALICIOUS — xokizawotanibotepix.pdf

MALICIOUS — xokizawotanibotepix.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 7555c83ba5aaf1727dfdcca2e7a5ae737c6f560672b4a8d1bb67f44f1a0530a8
• SHA-1: 3bfb57272ead2a3099695e6c75c907f2840d77b3
• MD5: 8f6ebfcf927ffb15a14ed56331116031
• ssdeep: 1536:2cJCjxCXrhOoF/Y4IEqDeOR0S+XhyPpGiwZs+gwToWGpOGoWZnIz5rAWv78JacWO:X7hOoFw4IESeORgdZ9gwT9GJIzN37eLn
• TLSH: T1333AC0F3219BDE4C76979F036AE62015A44ED7996232DAA0558CFA3C887C67D7F00E01
• Submitted as: xokizawotanibotepix.pdf
• File type: pdf · Size: 95876 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://medvor.ru/uplcv?utm_term=pdf+in+iframe+html, http://axwelindia.com/uploads/lewixaf.pdf, https://capital-tic.com/upload/ckfinder_temp/files/20210602141633.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://medvor.ru/uplcv?utm_term=pdf+in+iframe+html
• http://axwelindia.com/uploads/lewixaf.pdf
• https://capital-tic.com/upload/ckfinder_temp/files/20210602141633.pdf
• https://cremeconferences.com/wp-content/plugins/super-forms/uploads/php/files/8d9383bd0281d4c6b74f4f4479524a03/10152445637.pdf
• https://www.blackandwhite-salon.com/wp-content/plugins/super-forms/uploads/php/files/tmp/24116038803.pdf
• http://www.magicapro.it/wp-content/plugins/formcraft/file-upload/server/content/files/1606fade8c5e5d---pufedudeza.pdf
• http://jubileejec.com/userfiles/files/45289552103.pdf
• http://doktor-okonski.pl/uploadimg/file/10013189051.pdf
• http://meetburgerusa.com/uploads/files/tuzugigufafumitajewawazo.pdf
• https://sthouseluxury.com/upload/files/60488742327.pdf
• https://eprobatdz.com/ckfinder/userfiles/files/66687629485.pdf
• http://agataklimowska.pl/userfiles/file/zokodosotineta.pdf
• http://kprmk.pl/userfiles/file/zuzakegabip.pdf
• https://givemeit.ru/wp-content/plugins/super-forms/uploads/php/files/f4f9f2611a04d3c0e02dc8b928712209/13042011894.pdf
• http://ahdongjiu.com/upload_fck/file/2021-5-4/20210504115257183607.pdf
• http://dongduong.net/Images_upload/files/77875178829.pdf
• http://tencanpowder.com/d/files/vitotebin.pdf
• https://bettenbaehren.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606f32f57c4fa---11919274818.pdf
• https://fiscalonline.ro/app/webroot/files/userfiles/files/ligume.pdf
• http://southfieldhigh1973.com/clients/2/27/27a5067865c8334ad4a5a1fd7642c928/File/31985182777.pdf
• http://apluskleaning.com/admin/images/file/86519651563.pdf
• https://eliteswimmingpoolsinc.com/wp-content/plugins/super-forms/uploads/php/files/kb1ee2ftc9cr6gf4umn6ce4kr4/42549684641.pdf
• https://gtsonline.nl/wp-content/plugins/super-forms/uploads/php/files/edlh7vcmt9vvov04mmvnk59rso/30012078363.pdf
• http://betheaskssd.com/flash/betheaskssd.com/file/wekid.pdf
• https://adverto.ee/userfiles/file/5040798339.pdf

Embedded domains

• medvor.ru
• axwelindia.com
• capital-tic.com
• cremeconferences.com
• www.blackandwhite-salon.com
• www.magicapro.it
• jubileejec.com
• doktor-okonski.pl
• meetburgerusa.com
• sthouseluxury.com
• eprobatdz.com
• agataklimowska.pl
• kprmk.pl
• givemeit.ru
• ahdongjiu.com
• dongduong.net
• tencanpowder.com
• bettenbaehren.de
• southfieldhigh1973.com
• apluskleaning.com
• eliteswimmingpoolsinc.com
• gtsonline.nl
• betheaskssd.com
• efnnma.org
• jamoncup.es

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report