MALICIOUS — buxesikulusavaxuvinoxudom.pdf
MALICIOUS — buxesikulusavaxuvinoxudom.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
b7c8fc305a3f7cb4b6ca3edf5b31a749b909f7aac0fd00a764134651de84dcfd - SHA-1:
af7025c4b09262b9f1e9f7e28c42f43b13fbe27b - MD5:
9312ac021c3bd79df8ac0dcfee6035ce - ssdeep:
1536:PLODn6mpQk4jZzc2++oHUvheMFGrZIDuNeng+lbyWOpOaZEWNoqOe3lFPaF4/y0:DRk8F++C4heMFUIeennHaZJo63Hai - TLSH:
T15839D0F3A18BDE4C764A9F03A9EA015D6189E3887521EBA045CC766CC5BC4BEFF10950 - Submitted as: buxesikulusavaxuvinoxudom.pdf
- File type: pdf · Size: 91753 bytes
- Verdict: malicious (92/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://smidgel.ru/uplcv?utm_term=robux+codes+2020+list, http://www.sparkprototypes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612ea9ef79bf9---61290643023.pdf, https://armature.ir/cache/fck_files/file/luwarisopi.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://smidgel.ru/uplcv?utm_term=robux+codes+2020+list
- http://www.sparkprototypes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612ea9ef79bf9---61290643023.pdf
- https://armature.ir/cache/fck_files/file/luwarisopi.pdf
- https://tgvl.in/uploads/fck/files/xigefamivek.pdf
- http://oreade-breche.fr/userfiles/file/dubufemideniwazuloga.pdf
- http://csc-021.com/userfiles/file/20210903161710_2z0tjr.pdf
- http://esenkardeslerinsaat.com/resimlerfiles/gedejuxodowimetivisef.pdf
- http://oldmotorsclub.com/files/file/dixeguxal.pdf
- http://www.fuchingrading.com/upload/file/67779423067.pdf
- http://kirilmazbardak.com/userfiles/file/gazavumazogasodopurek.pdf
- https://gsm.company/ckfinder/userfiles/files/kadizafeg.pdf
- http://themultifold.com/wp-content/plugins/super-forms/uploads/php/files/5qo9uenuue5jp0mccfnq6bohq1/vojasorofipixokujiz.pdf
- http://keralastatetailorsassociation.com/userfiles/file/ninuvonimalusob.pdf
- http://abwingsva.com/uploads/files/gezojolimeriretoloxi.pdf
- http://swaving-stalinrichting.nl/ckfinder/userfiles/files/kizoxe.pdf
- http://edallyshop.com/upload/files/dojagino.pdf
- https://makojudo.pl/zdjecia/fck/file/dilikuzakisivugese.pdf
- http://konditsionery-zheleznodorozhnyi.ru/upload_picture/file/46815732612.pdf
- https://www.babetravelling.com/ckfinder/userfiles2/files/sumetosuxani.pdf
- http://shiokuda1.com/contents/files/tegezufedisusobifaladenas.pdf
- https://resicolor.com/upload/files/zuxinolarenukowareni.pdf
- http://rosesrealtyhomes.com/userfiles/files/97632179290.pdf
- http://kangmeideyiliao.com/uploadfile/file///2021090309384945.pdf
- http://steclotildehorton.ca/wp-content/plugins/formcraft/file-upload/server/content/files/161311fb88e156---68694422828.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- smidgel.ru
- www.sparkprototypes.com
- armature.ir
- tgvl.in
- oreade-breche.fr
- csc-021.com
- esenkardeslerinsaat.com
- oldmotorsclub.com
- www.fuchingrading.com
- kirilmazbardak.com
- themultifold.com
- keralastatetailorsassociation.com
- abwingsva.com
- swaving-stalinrichting.nl
- edallyshop.com
- makojudo.pl
- konditsionery-zheleznodorozhnyi.ru
- www.babetravelling.com
- shiokuda1.com
- resicolor.com
- rosesrealtyhomes.com
- kangmeideyiliao.com
- steclotildehorton.ca
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report