MALICIOUS — vujasexeregubaf.pdf

MALICIOUS — vujasexeregubaf.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 8a7979e357073064e8dded5e45a8b5428ec993d780c472119cc6aab6fe07a077
• SHA-1: 391fd50e74d33ca79d04ba75e8871420fcd375ce
• MD5: dbe24a89e4ca288b018588780404bb31
• ssdeep: 1536:ibYrtjehyj5Wfae6K0AgtiKP/O2lGKJisDueC3RWAU0EsLWxApOG9dxvf:/Reh65HtJP/FBdDnC3f/hU3GTF
• TLSH: T1F838D0F320DBDD9C7B9A9B4378AA01A8A04ED7891163F760588CB67CC9BD57CAF00550
• Submitted as: vujasexeregubaf.pdf
• File type: pdf · Size: 83558 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://studiomanzella.com/userfiles/files/babodelunojekik.pdf, http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d3b9f0e00e6---sojobipalovedoduzubufamur.pdf, http://rideco.hu/upload/file/pegafoba.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/cv9VXjIrmdE/uplcv?utm_term=dehleez+pe+mere+dil+ki+mp3+ringtone+free+download
• http://studiomanzella.com/userfiles/files/babodelunojekik.pdf
• http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d3b9f0e00e6---sojobipalovedoduzubufamur.pdf
• http://rideco.hu/upload/file/pegafoba.pdf
• https://nowackleverkusen.de/wp-content/plugins/formcraft/file-upload/server/content/files/160ac5c6d5af33---gotuna.pdf
• http://prmakeup.com/Image/files/kuwukokoniseleriti.pdf
• https://tcremich.lu/files/files/36028104353.pdf
• http://reszke.pl/fckeditor/editor/filemanager/connectors/php/file/vetobirapowumuxazuvipuxir.pdf
• http://qianlong99.org/ckfinder/userfiles/files/40557226020.pdf
• http://www.farparts.cl/wp-content/plugins/formcraft/file-upload/server/content/files/16076f502439d0---45798528642.pdf
• http://lumieretvie.com/userfiles/file/dodona.pdf
• http://cementfeet.com/userfiles/file/dadan.pdf
• http://szkolka-wiercioch.pl/files/file/19150712619.pdf
• https://deltagroup.bg/uploads/file/kubikakilini.pdf
• http://www.aluvascientific.com/UserFiles/file/fijekasimofamegojuropito.pdf
• http://www.recetasyconsejos.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cc74bb20f8---jujefipid.pdf
• http://www.oknookna.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16089c4469f23d---12342013428.pdf
• http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6951173bf5---61151581399.pdf
• https://mvpartners.be/images/uploadedimages/file/ruxepi.pdf
• http://aeskulap24h.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607cc9e7c8e91---53729747268.pdf
• http://itaindustrial.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c5f5c61f347---59699013237.pdf
• http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16098a0880f543---soxamagixujawesav.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/

Embedded domains

• feedproxy.google.com
• studiomanzella.com
• antwerp-rentals.com
• nowackleverkusen.de
• prmakeup.com
• reszke.pl
• qianlong99.org
• lumieretvie.com
• cementfeet.com
• szkolka-wiercioch.pl
• www.aluvascientific.com
• www.recetasyconsejos.com
• www.oknookna.pl
• www.movingintofreedom.com
• mvpartners.be
• aeskulap24h.de
• itaindustrial.com.br
• www.kissdocs.com.au
• www.w3.org
• purl.org
• ns.adobe.com
• rideco.hu
• tcremich.lu
• www.farparts.cl
• deltagroup.bg

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report