MALICIOUS — temexu.pdf

MALICIOUS — temexu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 846c3faeb13f3b2c84ce0c08f5405cc19bfc70f81a0501fdf35790e391e2cc5a
• SHA-1: b06eeb6062864460b3e6f7b2eef0d6a742462ff8
• MD5: b5bd0ad11a3d8b7a448d8b838fcae526
• ssdeep: 1536:9GFAFfVc8GEz2zD6gJpBBfW0LRWOpOaZEWDI0h3fKLf:A2tVc8GKaFJpHfW0LKaZPI0df0
• TLSH: T1E237D0E32197CD8CBB4B9F4339EA125CA449D3446175EBE04088F66C98BC6BDBF10A10
• Submitted as: temexu.pdf
• File type: pdf · Size: 70972 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://synerhu.ru/uplcv?utm_term=game+rpg+offline+android+2020, http://avandcie-energy.com/ckfinder/userfiles/files/ruwofuvinuwasovak.pdf, https://afmiletisim.afmiletisimajansi.info/resimler/files/maraxitipinexuxomazozebip.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://synerhu.ru/uplcv?utm_term=game+rpg+offline+android+2020
• http://avandcie-energy.com/ckfinder/userfiles/files/ruwofuvinuwasovak.pdf
• https://afmiletisim.afmiletisimajansi.info/resimler/files/maraxitipinexuxomazozebip.pdf
• http://skrabl.pl/www/rpbd/fck/file/bukavutobavanuso.pdf
• http://itfkarnataka.com/cvsprojects/SSK/Source/2.0.0/images/files/19965670349.pdf
• http://mwbright.com/upload_fck/file/2021-9-25/20210925191138617042.pdf
• http://www.anclupnapoli.it/userfiles/file/7256866838.pdf
• http://bluecars.pl/userfiles/file/ruvaposerelakuf.pdf
• http://kiszelyugyvediiroda.hu/docs/file/bupofapep.pdf
• http://formpart.com/upload/ckfinder/files/17598585116.pdf
• http://jiuxingchaoshi.com/uploads/file/272030259959.pdf
• http://clinicaveterinariabilancino.it/userfiles/files/tosifoxejugisinuzetiwupid.pdf
• https://alfa-clining.ru/wp-content/plugins/super-forms/uploads/php/files/375a4490993e0618d894c0c507903ba5/89690519226.pdf
• http://fabrikando.com/cmsimple/images/file/luxufifogobapa.pdf
• http://headlinesdinerla.com/uploads/files/sadegerenafobum.pdf
• http://www.kymenhome-etsinta.net/tiedostot/files/vosururapipobuvu.pdf
• http://inphilong.com/upload/files/10920314091.pdf
• http://exosportsante.fr/ckfinder/userfiles/files/sodasotat.pdf
• http://multiflex.ru/userfiles/file/40023349397.pdf
• http://euroambulans.pl/userfiles/file/2260607146.pdf
• https://propiedades.net/ckfinder/userfiles/files/4835214861.pdf
• https://cremeconferences.com/wp-content/plugins/super-forms/uploads/php/files/1448d5a719e5ac298fd0a58f45ade00e/32059095344.pdf
• https://millinerandassoc.com/files/file/somaxefudar.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/

Embedded domains

• synerhu.ru
• avandcie-energy.com
• afmiletisim.afmiletisimajansi.info
• skrabl.pl
• itfkarnataka.com
• mwbright.com
• www.anclupnapoli.it
• bluecars.pl
• formpart.com
• jiuxingchaoshi.com
• clinicaveterinariabilancino.it
• alfa-clining.ru
• fabrikando.com
• headlinesdinerla.com
• www.kymenhome-etsinta.net
• inphilong.com
• exosportsante.fr
• multiflex.ru
• euroambulans.pl
• propiedades.net
• cremeconferences.com
• millinerandassoc.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report