MALICIOUS — tezowemos.pdf

MALICIOUS — tezowemos.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 9e20e78d73b9a90945098acdff31cff488d7ace3cdb6d2f5168895c0534f5d18
• SHA-1: 1651d68ce835a2259758530bf6cc7299aeadfb86
• MD5: 60cbb4d622db3ee767e31db134e77053
• ssdeep: 1536:+UlM6LOMGfZo2iD6Q2+n98Fr+IcOhm0Wj15Fc/NOzrlBHOdWspO2cP6:Tq6iMNdDD2+n98kO215K/N0rlFO02x
• TLSH: T10339C0F721ABDD4C7389CB43B9FA1254744AD78CA132EA504088667CC8BC6BE7E14D61
• Submitted as: tezowemos.pdf
• File type: pdf · Size: 85041 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://www.hgbehringer.de/img/files/files/pijamarifunurikafuvo.pdf, https://delaneyllc.cfonewsletter.com/ckfinder/userfiles/files/35817071522.pdf, http://verypool.cn/images/upload/File/23419657820.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/S30rS-6n6vg/uplcv?utm_term=prince+of+persia+trilogy+pc+download
• http://www.hgbehringer.de/img/files/files/pijamarifunurikafuvo.pdf
• https://delaneyllc.cfonewsletter.com/ckfinder/userfiles/files/35817071522.pdf
• http://verypool.cn/images/upload/File/23419657820.pdf
• https://hotelite.in/userfiles/file/winuvapipilan.pdf
• https://ceccarmaramures.ro/userfiles/file/wudeziwi.pdf
• http://pluimveebeurs.com/userfiles/file/50369251300.pdf
• http://jolanyee.com/upload/files/202109080053062187.pdf
• https://amartzon.store/wp-content/plugins/super-forms/uploads/php/files/3860765d3d75c701e1825f91b726863b/belom.pdf
• https://slavica.ru/wp-content/plugins/super-forms/uploads/php/files/391345996b8c02a88adc916fac8b20e8/kivijagodatibumokopov.pdf
• https://kes-stv.ru/wp-content/plugins/super-forms/uploads/php/files/17d1eb04e2d6a75ab1cc4d91b1bf296d/46063731543.pdf
• http://mecateengenharia.com.br/ckfinder/userfiles/files/puvimipulanidanu.pdf
• https://rainbowprinter.com/app/webroot/files/file/ruzurupumufuravalomawuxan.pdf
• https://oreopay58.com/ckfinder/userfiles/files/vuvepoduvenejemikibo.pdf
• http://mellorymotors.ru/admin/ckfinder/userfiles/files/somarotudavexigez.pdf
• http://chieucoingason.vn/files/wipigavagasugoteve.pdf
• https://nasikampung.info/contents/files/18158092044.pdf
• http://bastola.org/userfiles/file/96342312968.pdf
• http://licausi.it/userfiles/files/8914762862.pdf
• https://magerp.org/upload/files/guwivi.pdf
• https://gestionarival.com/userfiles/file/92753236120.pdf
• https://kingyao.com/uploadfiles/files/20210904_102037_9044.pdf
• http://www.jimenez-casquet.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612ef8d30bf14---85622287679.pdf
• https://jahanchart.ir/data/files/file/dememufiwix.pdf
• https://amrapalispot.com/userfiles/file/bexedenevulodubujo.pdf

Embedded domains

• feedproxy.google.com
• www.hgbehringer.de
• delaneyllc.cfonewsletter.com
• verypool.cn
• hotelite.in
• pluimveebeurs.com
• jolanyee.com
• amartzon.store
• slavica.ru
• kes-stv.ru
• mecateengenharia.com.br
• rainbowprinter.com
• oreopay58.com
• mellorymotors.ru
• nasikampung.info
• bastola.org
• licausi.it
• magerp.org
• gestionarival.com
• kingyao.com
• www.jimenez-casquet.com
• jahanchart.ir
• amrapalispot.com
• www.w3.org
• purl.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report