MALICIOUS — gijaxagogosugakugub.pdf

MALICIOUS — gijaxagogosugakugub.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: ad7e9c2413199121c8950f0852cc720ea2b2e41ff639588d7a60d6e6eac61334
• SHA-1: e82b292bae1aefd40cbfb644a52890819c3bb4c0
• MD5: 1d35bdb135702628d1d3434f3fb4a7b2
• ssdeep: 1536:PrprFTdNHM5Y/GdaEFQkFjb48JW1qr/vuniMBEukWD+TA8fFbarC97nTWXpO/S2u:j3Y5Y+daEF5U8w6vgDvwAOF2rUTF/Y
• TLSH: T10939C0F3619BDC9C3BDB5F0364FA106C64C9D78D2232ABA055C8B56CC47C9ADBA10921
• Submitted as: gijaxagogosugakugub.pdf
• File type: pdf · Size: 92314 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://ozdermusavirlik.net/userfiles/file/nunare.pdf, http://sromedical.com/file_media/file_image/file/vetazefut.pdf, http://mellorymotors.ru/admin/ckfinder/userfiles/files/dikojig.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/6naE_Nh8_CY/uplcv?utm_term=adults+in+the+room+watch+online
• http://ozdermusavirlik.net/userfiles/file/nunare.pdf
• http://sromedical.com/file_media/file_image/file/vetazefut.pdf
• http://mellorymotors.ru/admin/ckfinder/userfiles/files/dikojig.pdf
• http://hidropro.hu/upload/78015586431.pdf
• http://beverly.kopanramen.com/uploads/files/forekenogewemapifasox.pdf
• http://begemot-rus.com/uploadfiles/file/2021091623090373499.pdf
• https://kasihpaham.com/contents/files/suwinu.pdf
• http://in-dapt.com/wp-content/plugins/formcraft/file-upload/server/content/files/16136b757a1ef7---80094366500.pdf
• http://fujiya-la.com/uploads/files/30162943239.pdf
• http://timatey.kz/wp-content/plugins/super-forms/uploads/php/files/dg6c0phonk4u8cj2oqdohlo7f4/xejanusefudomesoluluzew.pdf
• http://thietbiotoviet.com/Images_upload/files/47397210744.pdf
• http://synfarm.com/upload/files/65065084501.pdf
• https://cafesca.mx/ckfinder/userfiles/files/79088411852.pdf
• http://agmapure.com/upload/files/xakupusivigaroseva.pdf
• https://economiadecomunion.com/ckfinder/userfiles/files/80658335638.pdf
• https://maidintown.co.uk/wp-content/plugins/super-forms/uploads/php/files/3c6fe24355237c9364932c06fe39a91e/47250981492.pdf
• http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613ff5b79ece9---lasikogi.pdf
• http://arabic.cz/ckfinder/userfiles/files/wiranafolakagagugebelim.pdf
• http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/1613661b715d9b---kipubefosetodejetevukusiw.pdf
• https://sanghvicranes.com/staging/media/59401368245.pdf
• http://enotecagaribaldi.it/userfiles/files/bisigemesivolasozoba.pdf
• http://wellfoto.cz/pictures/files/jupinikepabufewapak.pdf
• https://doitsolutions.co/wp-content/plugins/super-forms/uploads/php/files/1a0458f8a37284942f9843d28a9cf0d9/rogixibudobenuka.pdf
• https://armenia4d.com/contents/files/99220131125.pdf

Embedded domains

• feedproxy.google.com
• ozdermusavirlik.net
• sromedical.com
• mellorymotors.ru
• beverly.kopanramen.com
• begemot-rus.com
• kasihpaham.com
• in-dapt.com
• fujiya-la.com
• thietbiotoviet.com
• synfarm.com
• cafesca.mx
• agmapure.com
• economiadecomunion.com
• maidintown.co.uk
• hellnocancershow.com
• www.cuerpomenteyespiritu.es
• sanghvicranes.com
• enotecagaribaldi.it
• doitsolutions.co
• armenia4d.com
• www.w3.org
• purl.org
• ns.adobe.com
• hidropro.hu

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report