MALICIOUS — vazudila.pdf

MALICIOUS — vazudila.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: b9f174b75033a49fb4163470fd599376fbc25347655c2c532d4264ffb6d6ad79
• SHA-1: d71a7085d262a2e338fed8f0cc5c205db67a8363
• MD5: bc753272cf8661733087f3a45645b3bf
• ssdeep: 1536:vD2PHDgvnzwEKCMUKbA2HlXo2G4z8GuOJYnk8VRtlAPdkRWABl8eP/NW8pO+HNFw:OHDIHKCMR7HlX/G4z85N/DjBvP/8+c
• TLSH: T1A13AD0F32097CE9C3A5BAB4365E6119C608BE3C92232DB50905CF26CD46C9BDBF14A51
• Submitted as: vazudila.pdf
• File type: pdf · Size: 93117 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://irlanc.ru/uplcv?utm_term=osrs+gold+crafting, https://ocvirapuato.com.mx/wp-content/plugins/super-forms/uploads/php/files/0e48c8b1c73e68359ab443deb77f73f7/dokigux.pdf, http://clinivetmadonnadirosa.eu/userfiles/files/wimisowoso.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://irlanc.ru/uplcv?utm_term=osrs+gold+crafting
• https://ocvirapuato.com.mx/wp-content/plugins/super-forms/uploads/php/files/0e48c8b1c73e68359ab443deb77f73f7/dokigux.pdf
• http://clinivetmadonnadirosa.eu/userfiles/files/wimisowoso.pdf
• https://hps-gruppe.com/wp-content/plugins/super-forms/uploads/php/files/12vc6k8fob7uq3jmnuji0sna2b/kuvopupemelex.pdf
• http://pelesiuvalymas.lt/i/File/74879243072.pdf
• http://hattingtoemrerogsnedker.dk/userfiles/file/79653888215.pdf
• http://vanillasky-ch.com/images/files/95263998426.pdf
• http://rufullthrottle.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b7a7c60e0d---namulivubevopo.pdf
• https://leuphuotcamap.com/uploads/image/files/kunasom.pdf
• https://srmhospitalities.com/images/bulk_images/files/32950753362.pdf
• http://ajarnveerapong.com/UserFiles/file/85683546311.pdf
• https://www.lightingsolutionsal.com/wp-content/plugins/super-forms/uploads/php/files/3ac9dea45ba28a5cf1bdc323d1953a01/59945038705.pdf
• http://moon-villa123.com/CKEdit/upload/files/nuvolizuvimusobofarune.pdf
• https://promocionesnma.com/wp-content/plugins/super-forms/uploads/php/files/1db1d122d3c29a175a94f6790d8ee308/67329247839.pdf
• https://www.opdrrustukalac.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b82aff5ef55---94460565565.pdf
• http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/16085d5af4c024---mufigu.pdf
• http://countrysquirefoods.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c7c94bd7da---88260034067.pdf
• https://mandalaconfeccao.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16081417673ccc---27336165571.pdf
• http://bazis-expertiza.ru/ckfinder/core/connector/php/files/90689447482.pdf
• https://prikolnaya.com/wp-content/plugins/super-forms/uploads/php/files/a152107a8f5e8f43cb0061a3e107ec7c/28757720829.pdf
• http://lifemartrealestateconnect.com/wp-content/plugins/super-forms/uploads/php/files/kbscfhq68da7vud0vpth00eo85/22839647187.pdf
• https://www.thecandystoresudbury.com/wp-content/plugins/super-forms/uploads/php/files/58ihdffoii9uhnmb4a2nk9in27/23253486027.pdf
• http://qiangka.com/ckfinder/userfiles/files/93494437894.pdf
• https://husvagnsexpo.se/wp-content/plugins/formcraft/file-upload/server/content/files/1607d46a85e7a6---mufuwosumoto.pdf
• http://averon.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160dddb23ad75c---nirenozux.pdf

Embedded domains

• irlanc.ru
• ocvirapuato.com.mx
• clinivetmadonnadirosa.eu
• hps-gruppe.com
• vanillasky-ch.com
• rufullthrottle.com
• leuphuotcamap.com
• srmhospitalities.com
• ajarnveerapong.com
• www.lightingsolutionsal.com
• moon-villa123.com
• promocionesnma.com
• www.opdrrustukalac.com
• aliancegroup.su
• countrysquirefoods.com
• mandalaconfeccao.com.br
• bazis-expertiza.ru
• prikolnaya.com
• lifemartrealestateconnect.com
• www.thecandystoresudbury.com
• qiangka.com
• husvagnsexpo.se
• averon.ca
• navigator-33.ru
• www.w3.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report