MALICIOUS — koperidanenulamix.pdf

MALICIOUS — koperidanenulamix.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: bb1a2d452f189bd2f467c516f7aa4eb249abf357e7977dbd91a42379a3bc9026
• SHA-1: b44917570f24451ee5c2407459f4781504bd4267
• MD5: 6168de5c5d143cdecefd2f9dfe336641
• ssdeep: 1536:cOH3fXWTFUgU60CB68Lkr+E5YY3Gxj7efeDxMsU:lPsMlCk8oSE5YDP0eDc
• TLSH: T17B36D0F3A0A7DC8C7767AB13B96B154C758AD78C2172E6A4448C376CC4B82FE5E21910
• Submitted as: koperidanenulamix.pdf
• File type: pdf · Size: 68858 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafftec.ru/strik?utm_term=minecraft+witchery+mod+1.+10.+2, https://cdn-cms.f-static.net/uploads/4497687/normal_5fad6c0f28c42.pdf, https://tadiselugel.weebly.com/uploads/1/3/4/5/134589133/lolugimetosap_pivivikomufo_dinoxi_zakatovuga.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafftec.ru/strik?utm_term=minecraft+witchery+mod+1.+10.+2
• https://cdn-cms.f-static.net/uploads/4497687/normal_5fad6c0f28c42.pdf
• https://tadiselugel.weebly.com/uploads/1/3/4/5/134589133/lolugimetosap_pivivikomufo_dinoxi_zakatovuga.pdf
• https://cdn-cms.f-static.net/uploads/4412159/normal_5fa76bbe85005.pdf
• https://dumetokewip.weebly.com/uploads/1/3/4/3/134394823/7971370.pdf
• https://uploads.strikinglycdn.com/files/012e4990-7e36-4805-929e-1b8c065e1dd5/6149116243.pdf
• https://cdn-cms.f-static.net/uploads/4366331/normal_5f8712f8aedc3.pdf
• https://uploads.strikinglycdn.com/files/1fd81258-29cd-4a6c-a032-d53f9fa83577/dikawixogowudemexis.pdf
• https://cdn-cms.f-static.net/uploads/4379370/normal_5fab66e4c511f.pdf
• https://xurafexejigaf.weebly.com/uploads/1/3/4/5/134588012/6398476.pdf
• https://gavuzolarot.weebly.com/uploads/1/3/4/4/134458525/kivurajigafozedoji.pdf
• https://cdn-cms.f-static.net/uploads/4410416/normal_5f96b84d7dcad.pdf
• https://cdn-cms.f-static.net/uploads/4365551/normal_5f8731673078a.pdf
• https://sovuzozasofebod.weebly.com/uploads/1/3/4/3/134343281/fazodagudaxuwadovej.pdf
• https://uploads.strikinglycdn.com/files/8b59d57c-a0b8-45f1-97d3-ca86f1eaa9a9/94554141465.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafftec.ru
• cdn-cms.f-static.net
• tadiselugel.weebly.com
• dumetokewip.weebly.com
• uploads.strikinglycdn.com
• xurafexejigaf.weebly.com
• gavuzolarot.weebly.com
• sovuzozasofebod.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report