MALICIOUS — gujotuxutedes.pdf
MALICIOUS — gujotuxutedes.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.
Identification
- SHA-256:
7624c4feed58a7522d66f13ba5db36dc1ccbc8f5d6b502f1c3e4d280cf7b9cbe - SHA-1:
4f4a0516e12380ed764495e38390cad3e4b4c529 - MD5:
acc053c49061584ffb98e3b5da3d2243 - ssdeep:
1536:P1kzby51gOgps/VPACx31U3t2qTE03wmgH+fYG/fMvi5jVaR6QhRiXW4gtH2hyQv:NkzbiopsxuAl0g38/fMK5HOQ/gtH2hF - TLSH:
T1AA3BD0B3A09BDD8C7A8E9F03AA662418710AD1C83623EBD451C86B5CC5BC7FD7E10911 - Submitted as: gujotuxutedes.pdf
- File type: pdf · Size: 103453 bytes
- Verdict: malicious (92/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://gbagencement.fr/uploads/file/doritiwedilutiw.pdf, https://mandalaconfeccao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607fd054bfb60---62873719935.pdf, https://www.prestigeautobody.com.au/wp-content/plugins/super-forms/uploads/php/files/b57537a9fa9cd65c7d350ac3f95e5a06/sudozelun.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=def+jam+ppsspp+game+download
- https://gbagencement.fr/uploads/file/doritiwedilutiw.pdf
- https://mandalaconfeccao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607fd054bfb60---62873719935.pdf
- https://www.prestigeautobody.com.au/wp-content/plugins/super-forms/uploads/php/files/b57537a9fa9cd65c7d350ac3f95e5a06/sudozelun.pdf
- http://travellightnepal.com/userfiles/file/komuvalamu.pdf
- https://capecoralliving.com/media/file/nivexifubogofomutigur.pdf
- https://pabausa.org/wp-content/plugins/formcraft/file-upload/server/content/files/1608473d2c0ef9---73950908269.pdf
- https://alternativecarrepair.com/userfiles/file/16042095131.pdf
- https://pensiuneavlasin.ro/wp-content/plugins/super-forms/uploads/php/files/9eflo3i1kfhrpeec9ku9j9tnjd/31853777975.pdf
- http://evabody.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160c37cddeb619---pefaretalulezimokinafugo.pdf
- https://christianboudreau.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075d59c1cc81---zapofe.pdf
- https://brunoamaranti.it/wp-content/plugins/super-forms/uploads/php/files/9ev3f7gddlda0p1auosb53nt04/88221623444.pdf
- http://www.siscard.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3e222b21b7---43409470763.pdf
- https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b183c4f2097---feguwogobusetuxup.pdf
- http://www.majoriscambio.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607ddb217c48f---89924402078.pdf
- http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608de27205214---kilanepe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- feedproxy.google.com
- gbagencement.fr
- mandalaconfeccao.com.br
- www.prestigeautobody.com.au
- travellightnepal.com
- capecoralliving.com
- pabausa.org
- alternativecarrepair.com
- christianboudreau.com
- brunoamaranti.it
- www.siscard.com
- atlasautoglass.com
- www.majoriscambio.com.br
- amtusa.com
- www.w3.org
- purl.org
- ns.adobe.com
- pensiuneavlasin.ro
- evabody.ro
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report