MALICIOUS — naxuwutifoxineb.pdf

MALICIOUS — naxuwutifoxineb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: b8c8831cdaf8f28c92de50905a7becc32f4297aad5adc4ab5f8bb4a86be7bf17
• SHA-1: 6ab8d5222fb2529bbe170ba324702114969dc36b
• MD5: e6cc037403bf551f94c8f34b0fb246a5
• ssdeep: 1536:VmTf8o2BzThaB3S028RcpgK3wRfpn4E/PvWOpOwrKW50t/LVCNVIBk:gf8o2NdaB3SHdpg6Ift/Pswrf0YT
• TLSH: T1CB37C0F321A7DD9C7BCBDB4759F6119C504AE7886132E660448CB62DD87C9BEAF00A10
• Submitted as: naxuwutifoxineb.pdf
• File type: pdf · Size: 74076 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://raduzhniy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b5b14dd7323---23232964624.pdf, https://alarrabnews.com/images/content/content/file/93444128749.pdf, http://malopolskiszlakwinny.pl/upload/File/baxixavuvif.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=marketing+4.0+pdf
• http://raduzhniy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b5b14dd7323---23232964624.pdf
• https://alarrabnews.com/images/content/content/file/93444128749.pdf
• http://malopolskiszlakwinny.pl/upload/File/baxixavuvif.pdf
• http://daoltrading.com/userData/board/file/litagusazemesixexupadujob.pdf
• https://mygoaltv.org/ipp/images/uploads/files/foxaloduma.pdf
• http://camelliafb.com/uploads/files/202108310137122653.pdf
• http://www.barankayalar.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160aff7628df6c---vitakajinijumugomiwi.pdf
• http://sushigonewildtogo.com/uploads/files/58707156746.pdf
• http://womenwhorockarkansas.com/clients/4/4c/4cfcdabbb7b8ad81bafe9a4295858145/File/24334928507.pdf
• http://julieesteban.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087308b46867---12150960312.pdf
• http://tokyo-sanritsu.com/userfiles/file/bifojegisesezipilixora.pdf
• https://brianhigbielaw.com/UserFiles/file/35291071342.pdf
• https://99shayari.in/userfiles/files/vewufawimamimexij.pdf
• https://x-software.cz/data/file/15798180891.pdf
• https://yuktiedu.com/wp-content/plugins/super-forms/uploads/php/files/b3c5c0a50a71a627b0974c170bb06231/bulagejobawivoduxadave.pdf
• http://littlepearlspublishing.in/data/eimages/file/menusekebafifumolovezigi.pdf
• http://www.kocay.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1607754b50ca07---fabozuv.pdf
• https://omomediacion.com/wp-content/plugins/super-forms/uploads/php/files/af44a807389391fbe3d5dc0914774723/pekalila.pdf
• http://soupworld.de/upload/file/14393165301.pdf
• http://thietbiotovn.com/Images_upload/files/wewefibemupo.pdf
• https://laxmigrouppune.com/wp-content/plugins/super-forms/uploads/php/files/eda3b87b5e4bd0a5fcaf0e5b7e950af9/89549196987.pdf
• https://szaniterplaza.hu/ckfinder/userfiles/files/41700517647.pdf
• http://thewellmanteam.com/userfiles/files/56168794839.pdf
• https://laserbeautymachine.net/d/files/76274420599.pdf

Embedded domains

• feedproxy.google.com
• raduzhniy.com
• alarrabnews.com
• malopolskiszlakwinny.pl
• daoltrading.com
• mygoaltv.org
• camelliafb.com
• sushigonewildtogo.com
• womenwhorockarkansas.com
• julieesteban.com
• tokyo-sanritsu.com
• brianhigbielaw.com
• 99shayari.in
• yuktiedu.com
• littlepearlspublishing.in
• omomediacion.com
• soupworld.de
• thietbiotovn.com
• laxmigrouppune.com
• thewellmanteam.com
• laserbeautymachine.net
• www.w3.org
• purl.org
• ns.adobe.com
• www.barankayalar.com.tr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report