MALICIOUS — los_atributos_de_dios_segun_la_biblia.pdf

MALICIOUS — los_atributos_de_dios_segun_la_biblia.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 90bea993c7c908830fe7e99e59caa06fb5e89b35497a9010f96702b9011d0cde
• SHA-1: 9d14d57c7fcb2934ffae69ab5c7ba9298ad50751
• MD5: 449a1af2a03f09579737ffcf55fb6388
• ssdeep: 1536:rJytwuUsPurDyVUiWiMovyHNfwurVt6+XzN8HIXVyu0WZestHN:Ne8yVBWLovkfwU9NaSVR02es7
• TLSH: T1A437D0F3D267CECC7A8B4F83A9A6555C6549D2886223D76001887B2DC1BC3BE7FA0511
• Submitted as: los_atributos_de_dios_segun_la_biblia.pdf
• File type: pdf · Size: 72174 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!449A1AF2A03F
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://yafferge.ru/strik?utm_term=los+atributos+de+dios+segun+la+biblia, http://jifupupuf.epizy.com/boomerang_tamil_film_songs.pdf, http://sijuzoratimi.epizy.com/modern_islamic_political_thought_hamid_enayat.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://yafferge.ru/strik?utm_term=los+atributos+de+dios+segun+la+biblia
• https://s3.amazonaws.com/sixenogafopoj/anniversary_card_template.pdf
• http://jifupupuf.epizy.com/boomerang_tamil_film_songs.pdf
• http://sijuzoratimi.epizy.com/modern_islamic_political_thought_hamid_enayat.pdf
• https://s3.amazonaws.com/jobavo/bihar_board_result_marksheet_2019.pdf
• http://widuzuduzudovix.iblogger.org/61586417034.pdf
• http://volemefejosi.rf.gd/vilenumugejobabavav.pdf
• http://vnatural.space/najotigenudabimujofolegw55sp.pdf
• https://s3.amazonaws.com/bepukuba/bivabojoxovazuwuwav.pdf
• http://zatejufeg.rf.gd/gizozuravepadunizabizu.pdf
• http://texazufuvo.rf.gd/81043517519.pdf
• http://jilovin.epizy.com/metric_system_conversions_worksheet.pdf
• http://modebedunizux.iblogger.org/97147232657.pdf
• http://rujawobezixevib.iblogger.org/class_app_http_controllers_numberformatter_not_found.pdf
• http://mirabawuwoku.epizy.com/pubifexalutuvuf.pdf
• http://wijogural.epizy.com/gladiator_2000_parents_guide.pdf
• http://nasuxenabo.epizy.com/jenaxuxerawumopo.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• yafferge.ru
• s3.amazonaws.com
• jifupupuf.epizy.com
• sijuzoratimi.epizy.com
• widuzuduzudovix.iblogger.org
• vnatural.space
• jilovin.epizy.com
• modebedunizux.iblogger.org
• rujawobezixevib.iblogger.org
• mirabawuwoku.epizy.com
• wijogural.epizy.com
• nasuxenabo.epizy.com
• www.w3.org
• purl.org
• ns.adobe.com
• volemefejosi.rf.gd
• zatejufeg.rf.gd
• texazufuvo.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report