MALICIOUS — sikesegit.pdf
MALICIOUS — sikesegit.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.
Identification
- SHA-256:
a418168af90f1ca346718dd2f8db631d6fb1efb8937e7f3ada7e4de4d58fda62 - SHA-1:
daf7859f16248dcdf077c52aec3579d6526e0f7b - MD5:
5d2de9abce34dccd4c1245b7d0f0f6a8 - ssdeep:
1536:bpoxkUpI/EjbkKSt/yRzxDnkcejTTUJrim/wGJvpXsZwZpFJF8DMacoG2rd7MZE:SkUpdQyDsTT42m/7JOMpFJ/oD - TLSH:
T1D737D0F36153CE4CBA9F9B437DBA116CB186D7C81173A9505884B63DC8AC2BE7E14902 - Submitted as: sikesegit.pdf
- File type: pdf · Size: 74560 bytes
- Verdict: malicious (92/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!5D2DE9ABCE34
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://baarspo.ru/wb?keyword=piggy%20in%20carnival%20chapter%208%20trailer, http://reduslim-ufficialesito.site/parent_cue_for_churcheshioap.pdf, http://tesusaruva.epizy.com/free_b_flat_trumpet_sheet_music.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://baarspo.ru/wb?keyword=piggy%20in%20carnival%20chapter%208%20trailer
- http://reduslim-ufficialesito.site/parent_cue_for_churcheshioap.pdf
- http://tesusaruva.epizy.com/free_b_flat_trumpet_sheet_music.pdf
- https://s3.amazonaws.com/woxorojero/86321574627.pdf
- http://zurabogefu.rf.gd/76340398868.pdf
- http://duxurajixi.rf.gd/html_form_post_array.pdf
- http://timelessdecorum.com/doll_house_cake_cookingi9ae8.pdf
- https://cdn.sqhk.co/fuzekofuwe/GieoVd8/24402807009.pdf
- https://cdn.sqhk.co/xekemini/ig6Cick/buzijetopu.pdf
- http://namerunu.rf.gd/tuwelafonilulero.pdf
- https://s3.amazonaws.com/pululusodogi/pisemubuworizum.pdf
- https://s3.amazonaws.com/dukajevo/71352591826.pdf
- http://giveaway2020.info/examen_resuelto_enlace_quimico_2_bachilleratoxws5y.pdf
- http://lynciguest.com/stephen_gossontzf2t.pdf
- https://cdn.sqhk.co/gimexigerub/WWhdiaP/video_player_banner_twitch_free.pdf
- http://form-lnstagramverifiedbadges.com/cross_stitch_patterns_free_to_download_babyreebq.pdf
- http://dresdenpharma.ru/amazon_gutschein_online_kaufen_rossmanna27xw.pdf
- http://tafinefonekon.rf.gd/daily_staff_attendance_sheet_format_excel.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- baarspo.ru
- reduslim-ufficialesito.site
- tesusaruva.epizy.com
- s3.amazonaws.com
- timelessdecorum.com
- cdn.sqhk.co
- giveaway2020.info
- lynciguest.com
- form-lnstagramverifiedbadges.com
- dresdenpharma.ru
- www.w3.org
- purl.org
- ns.adobe.com
- zurabogefu.rf.gd
- duxurajixi.rf.gd
- namerunu.rf.gd
- tafinefonekon.rf.gd
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report