MALICIOUS — zinezixiriferok.pdf
MALICIOUS — zinezixiriferok.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.
Identification
- SHA-256:
b7c109a5ca06b07b834ed68d35a6e5dc4435d3a3b18eca29521b8805acb79036 - SHA-1:
23d9ae9da2cfcf3427428dc4d21f89e2a615e1fd - MD5:
1880e4ea0030af61ff4cc886ce385ff7 - ssdeep:
1536:pnJh/8T9WfpOcAxdkINYchZBOjy+k1GCEOH2xHdbBINCaAJjlq/iu3WWn65bxkI7:R8sfMcAxdvYchZEjy+k1GROH2xHxHruA - TLSH:
T1A43AD1F360DBCD4C7A4B4F4379EA10599086D38C6261EA505188BA7CD5BCEFEBE10950 - Submitted as: zinezixiriferok.pdf
- File type: pdf · Size: 94128 bytes
- Verdict: malicious (92/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://cructi.ru/uplcv?utm_term=download+idm+crack+64+bit, https://tapuionoticias.com/ckfinder/files/9118243508.pdf, http://cbelmira.com/wp-content/plugins/super-forms/uploads/php/files/f222334e89381fef426af67841e72820/bagubodarejar.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cructi.ru/uplcv?utm_term=download+idm+crack+64+bit
- https://tapuionoticias.com/ckfinder/files/9118243508.pdf
- http://cbelmira.com/wp-content/plugins/super-forms/uploads/php/files/f222334e89381fef426af67841e72820/bagubodarejar.pdf
- https://avistravel.ro/userfiles/file/jodap.pdf
- https://palezieux.com/ckfinder/userfiles/files/futexo.pdf
- http://poaglasses.com/uploads/files/202109170547284834.pdf
- https://www.a2zmedical.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16139ddda65b8b---89094814825.pdf
- http://rideco.hu/upload/file/rinevu.pdf
- http://venkateshservices.com/uploads/23804849127.pdf
- http://sage-chem.com/image/files/20210911_220452.pdf
- http://ngor2-3.com/file_media/file_image/file/19519503224.pdf
- http://paradisoseminatrici.it/userfiles/files/meruwuro.pdf
- http://fskyok.com/uploadfile/files/76121240786.pdf
- https://www.ayersworthglen.com/wp-content/plugins/formcraft/file-upload/server/content/files/16137935509eba---ridufa.pdf
- http://cabini.it/userfiles/files/zotifalemozulemesex.pdf
- https://eko-briketes.lv/userfiles/files/51644741842.pdf
- https://isigakizima.net/img/tmp/file/41416878445.pdf
- http://31kouqiang.com/userfiles/file/1630528304.pdf
- https://horizontire.com/userfiles/file/20610433417.pdf
- https://aucordechasse.fr/vosImages/borutetidadize.pdf
- https://menu2uplus.com/images/file/28470148686.pdf
- http://homeloanz.net/images/e/file/sijaropan.pdf
- https://gujaratisamajparis.org/upload/files/rekagubigopugoba.pdf
- https://www.booster-p.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613a6bedae2c2---newujenofopom.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cructi.ru
- tapuionoticias.com
- cbelmira.com
- palezieux.com
- poaglasses.com
- www.a2zmedical.com.au
- venkateshservices.com
- sage-chem.com
- ngor2-3.com
- paradisoseminatrici.it
- fskyok.com
- www.ayersworthglen.com
- cabini.it
- isigakizima.net
- 31kouqiang.com
- horizontire.com
- aucordechasse.fr
- menu2uplus.com
- homeloanz.net
- gujaratisamajparis.org
- www.booster-p.com
- www.w3.org
- purl.org
- ns.adobe.com
- avistravel.ro
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report