MALICIOUS — fizevuba.pdf

MALICIOUS — fizevuba.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

SHA-256: b9831efdeea3a86fa9a8cab2b68f89270f994aee59ca376610df8637a1c00a9e
SHA-1: eca01fcf15aba33bb85d7a3a606b75cc72026af8
MD5: 3ed8fe7d04cbc3c5cdb0fab196e8c2f8
ssdeep: 1536:0fboF7wdF2ME9j8mviOSAFnv/iAF9cm0tc6wcAlNlQ:0TkEd0TjRhSg/iOEt/mls
TLSH: T17437E0F331CBDE8DB6C67F07AAE6106D5089D6906132DA644488FA2DE1B82BD7E01D11
Submitted as: fizevuba.pdf
File type: pdf · Size: 74995 bytes
Verdict: malicious (92/100)

Detections (5 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!3ED8FE7D04CB
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: https://allytemp.ru/uplcv?utm_term=alcatel-lucent+ip+touch+4028+phone+user+manual, https://completecollegestrategies.com/wp-content/plugins/super-forms/uploads/php/files/1943d03975120bdfe21d44f0ed562fd6/novolipavomaf.pdf, https://dezsredstvompx.ru/wp-content/plugins/super-forms/uploads/php/files/735fd0ccd21e20cad7b6d54de8621d85/kopasupusunanukobazaromo.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://allytemp.ru/uplcv?utm_term=alcatel-lucent+ip+touch+4028+phone+user+manual
https://completecollegestrategies.com/wp-content/plugins/super-forms/uploads/php/files/1943d03975120bdfe21d44f0ed562fd6/novolipavomaf.pdf
https://dezsredstvompx.ru/wp-content/plugins/super-forms/uploads/php/files/735fd0ccd21e20cad7b6d54de8621d85/kopasupusunanukobazaromo.pdf
https://www.nobleorthodontic.com/wp-content/plugins/super-forms/uploads/php/files/19ab2bddde813a0dde9b4563b0a22077/wogepekirebuduf.pdf
http://younewstoday.com/task/userimages/file/favejuvibotatekasixazuzil.pdf
https://www.hungarianassociation.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ebc85e562f---zinezutaxenakigetowip.pdf
https://ddriu.hu/wp-content/plugins/super-forms/uploads/php/files/e027265446534ebee465e0699f8f12d0/51644816495.pdf
http://www.lbf-cosmetics.com/website/wp-content/plugins/formcraft/file-upload/server/content/files/1607b6bc327ce7---vevikolije.pdf
http://e-cluny.cz/UserFiles/file/20754980698.pdf
https://sakitonus.ru/wp-content/plugins/super-forms/uploads/php/files/1cb5d1f820e7851307f295f9f2eaf3de/59369898404.pdf
https://bataretak.com/img/files/file/39035661365.pdf
http://apartmaji-zunicmile.com/uporabnik/file/sijovebazazurefevugali.pdf
http://asbufestival.com/uploads/FCK_files/file/60630162406.pdf
http://eurogeographyjournal.eu/admin/fckfiles/file/nulotopa.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

allytemp.ru
completecollegestrategies.com
dezsredstvompx.ru
www.nobleorthodontic.com
younewstoday.com
www.hungarianassociation.com
www.lbf-cosmetics.com
sakitonus.ru
bataretak.com
apartmaji-zunicmile.com
asbufestival.com
eurogeographyjournal.eu
www.w3.org
purl.org
ns.adobe.com
ddriu.hu
e-cluny.cz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report