MALICIOUS — pifelonuluwaxuf.pdf
MALICIOUS — pifelonuluwaxuf.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7704fd3bd8796591ad204af63666f5bacb01e9dff66f200b852e91eee36559e3 - SHA-1:
1e18f61b01d74266f8d69672af24080e26dad715 - MD5:
2e24203b1ccf8c4679703e111cf2a341 - ssdeep:
1536:4RKFeiVXxgWwI7UJ6B0ZIXp6E62FyssTzAFkf2pZMvZmOWUpO7qWISv1uXCx2JP3:VFxghI7U1qlRwsKSuvZm57qSv1uyx2Jv - TLSH:
T12338BFE321A7ED8C76DADF0374EB35A464C6E7881122AAA0518CB53CC57C6BE7F50910 - Submitted as: pifelonuluwaxuf.pdf
- File type: pdf · Size: 83850 bytes
- Verdict: malicious (96/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://khyatiinfotech.biz/ckfinder/userfiles/files/muzowusuxokuxupikaxise.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://pistant.ru/uplcv?utm_term=how+full+is+your+bucket+children%27s+book+pdf, http://cnzhongkui.com/fckeditor/editor/filemanager/connectors/php/uploads/file/132050385408.pdf, http://witnesstherealist.com/wp-content/plugins/super-forms/uploads/php/files/ba081b1f46a78760ea2327d5a0d7031c/lijadodobimuwidojefepilej.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://pistant.ru/uplcv?utm_term=how+full+is+your+bucket+children%27s+book+pdf
- http://cnzhongkui.com/fckeditor/editor/filemanager/connectors/php/uploads/file/132050385408.pdf
- http://witnesstherealist.com/wp-content/plugins/super-forms/uploads/php/files/ba081b1f46a78760ea2327d5a0d7031c/lijadodobimuwidojefepilej.pdf
- https://khyatiinfotech.biz/ckfinder/userfiles/files/muzowusuxokuxupikaxise.pdf
- https://meridianchem.com/meridian/ckfinder_userfiles/files/zinezixiriferok.pdf
- http://www.thaiboat.net/image/upload/File/gurakiwowuzidadiji.pdf
- http://www.jobibon.com/admin/userfiles/file/13831445181.pdf
- http://dulwichtaxi.com/survey/userfiles/files/lamir.pdf
- https://snapstudios.ca/userfiles/file/kotaxeremumiravaw.pdf
- http://perfectionistpaintingnj.com/ckfinder/userfiles/files/bakawemapiloxenovidefa.pdf
- https://cradlegold.com/wp-content/plugins/super-forms/uploads/php/files/hogr1kvokv2g24jvs8341qqc95/mavujimiteb.pdf
- http://yushendesign.com/images_fck/file/1631509778.pdf
- http://boothbayharborshipyard.com/userfiles/file/74044422626.pdf
- https://gymlesgeants.com/upload/editor/file/43375145657.pdf
- http://dalboncostruzioni.it/userfiles/files/350318675.pdf
- https://chsromania.managenet.ro/images/file/xibirazivifarukinamujade.pdf
- https://alkoplast.rs/files/fopitolaferon.pdf
- http://karmakonnect.org/DrumiBhatt/karmakonnect.org/Final/ckeditorimage/files/83650150780.pdf
- http://fasson.vip/images/editor/files/xorevebimizuvejejidelo.pdf
- http://thevale.us/userimages/44053421453.pdf
- http://goldartline.ua/userfiles/file/68547634225.pdf
- http://hyundai-baoloc.com/luutru/files/41087446968.pdf
- http://peneleos.pl/userfiles/file/15842627468.pdf
- http://www.dilipprabhavalkar.com/images/file/fuwinefakep.pdf
- https://sitarasign.ir/data/file/vakogeruravuzolipojab.pdf
Embedded domains
- pistant.ru
- cnzhongkui.com
- witnesstherealist.com
- khyatiinfotech.biz
- meridianchem.com
- www.thaiboat.net
- www.jobibon.com
- dulwichtaxi.com
- snapstudios.ca
- perfectionistpaintingnj.com
- cradlegold.com
- yushendesign.com
- boothbayharborshipyard.com
- gymlesgeants.com
- dalboncostruzioni.it
- karmakonnect.org
- fasson.vip
- thevale.us
- goldartline.ua
- hyundai-baoloc.com
- peneleos.pl
- www.dilipprabhavalkar.com
- sitarasign.ir
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report