MALICIOUS — pikajogurijugenonozafuj.pdf

MALICIOUS — pikajogurijugenonozafuj.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: a0f361171fbf03913323804e959b193df5ee6f9d5ced55b89706baf9819b7f71
• SHA-1: 1bc72979987673219f7361debc4e33528f4975fa
• MD5: aa40794a90c9d0d194d53cdee94326d9
• ssdeep: 1536:8d8wvwTvUcAbx1rISNZbJDUjfvBExPWOpOaZiejkhCWa3RJEbZ0:C8wvwXu1bjJDULBHaZieAiJEy
• TLSH: T1D738D0F3229BEC4C73579B0769F9106CB08AE3C865619A90414CB61C89BC6FEBF14951
• Submitted as: pikajogurijugenonozafuj.pdf
• File type: pdf · Size: 83397 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://laborke.ru/uplcv?utm_term=doc+to+pdf+android, https://larrialdiak.es/files/galeria/files/fosimovidegulisavagade.pdf, https://novinfasteners.com/userfiles/file/54010424672.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://laborke.ru/uplcv?utm_term=doc+to+pdf+android
• https://larrialdiak.es/files/galeria/files/fosimovidegulisavagade.pdf
• https://novinfasteners.com/userfiles/file/54010424672.pdf
• http://wonsakai.com/uploads/files/25811301979.pdf
• http://vcelari.naceradec.cz/includes/ckfinder/userfiles/files/10297929084.pdf
• http://sobinco.cz/ckfinder/userfiles/files/bigijuripegazowafaw.pdf
• https://s-serviss.lv/userfiles/file/66776012131.pdf
• https://refundsrefunds.com/wp-content/plugins/formcraft/file-upload/server/content/files/161374af23e4b6---bukofi.pdf
• http://beerskiboot.com/img/upload/file/95995982360.pdf
• https://cuatudongsaigon.vn/uploads/files/wijudesoruge.pdf
• https://oncetrabzon.com/resimler/files/67782057567.pdf
• http://2017.letnifestiwal.pl/ckfinder/userfiles/files/nanusufutuvar.pdf
• https://parc-hotel.info/file/lujutirogetomogezefus.pdf
• https://drmiamiconnect.com/wp-content/plugins/super-forms/uploads/php/files/c8a0b5e2c56c35e341b1c20854316bc4/78281017838.pdf
• https://fiberglasssupplydepot.com/userfiles/file/kufaj.pdf
• http://terapie-psi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16130ff279ee9c---zulur.pdf
• http://epmresearch.org/userfiles/files/toniwixa.pdf
• http://prodottoitalia.eu/userfiles/files/kejosejugumani.pdf
• http://terwaarde.be/ckfinder/userfiles/files/banenivizowazido.pdf
• http://aygroupmuh.com/image/files/33070004362.pdf
• https://rrvchefs.com/wp-content/plugins/super-forms/uploads/php/files/a777e87342c84d7b7cf7ed3b7638cd3b/nirigugudotemofirosanerim.pdf
• https://themodernla.com/wp-content/plugins/super-forms/uploads/php/files/b70b47a2063835d3e407541b5f87a3c3/lexarebixujakoze.pdf
• https://izyskately.ru/foto/ck/files/binosijifetinediv.pdf
• http://pokemom2.com/uploads/files/71850949322.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• laborke.ru
• larrialdiak.es
• novinfasteners.com
• wonsakai.com
• refundsrefunds.com
• beerskiboot.com
• oncetrabzon.com
• 2017.letnifestiwal.pl
• parc-hotel.info
• drmiamiconnect.com
• fiberglasssupplydepot.com
• epmresearch.org
• prodottoitalia.eu
• terwaarde.be
• aygroupmuh.com
• rrvchefs.com
• themodernla.com
• izyskately.ru
• pokemom2.com
• www.w3.org
• purl.org
• ns.adobe.com
• vcelari.naceradec.cz
• sobinco.cz
• s-serviss.lv

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report