MALICIOUS — jogogokufatu.pdf

MALICIOUS — jogogokufatu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: be723e3a706422be452f7ae0648a1c986f652f4f491e1e0232c73928dfd7fb3d
• SHA-1: f716e64c44ece9e31b3ae2baa9031ec12f84df4b
• MD5: 39266b5bb8475d583a2fda26bec32de0
• ssdeep: 1536:LNnBFMWToLXU0pzbCLL291/AmEaqhh0W9GqGgF9cCkOIU1WpW8pO7kt1:pnBFFToLXUaz2QB5E5UqGgF9c7U1WA78
• TLSH: T15437D0F3609BCD5C7B8FE707B4A7266C5489E68C15B2DA600488779CD8BC97DAE10B01
• Submitted as: jogogokufatu.pdf
• File type: pdf · Size: 74959 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://wastran.ru/uplcv?utm_term=michigan+manual+of+plastic+surgery+pdf, http://fertilityupdates.com/userfiles/files/46137517090.pdf, http://mlead.net/images/e/file/75518371303.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://wastran.ru/uplcv?utm_term=michigan+manual+of+plastic+surgery+pdf
• http://fertilityupdates.com/userfiles/files/46137517090.pdf
• http://mlead.net/images/e/file/75518371303.pdf
• http://score1forspencer.com/clients/4/45/4587145e2679cb7673d0e21b436e5c25/File/30723719882.pdf
• https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16076b4248a60b---43699738087.pdf
• http://remontnoedelo.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16072842b311f8---77020296815.pdf
• http://stepasidemedical.ie/images/uploads/file/56044692321.pdf
• https://yuktiedu.com/wp-content/plugins/super-forms/uploads/php/files/969a600f717388bb2573dc31ab482624/97763910379.pdf
• https://lcd96.ru/wp-content/plugins/super-forms/uploads/php/files/21160c83d239e4638eae6ec1539141b8/51792418929.pdf
• http://imagespa.mx/wp-content/plugins/formcraft/file-upload/server/content/files/160a117682f062---15967787572.pdf
• http://www.oknookna.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1606df599ba7c0---bavavimavawisijuruvijemuk.pdf
• https://balajitutorial.com/admin/userfiles/file/jezazas.pdf
• https://hoffmanowska.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16097443738c88---79928069937.pdf
• http://color-gateway.com/userfiles/file/wiwuvata.pdf
• https://osikovo.eu/webroot/img/content/files/tetemurorosatutazoj.pdf
• http://claudiodauelsberg.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c1c95f99255---fozebowebozakelaga.pdf
• https://asharfilalkulfi.com/ckfinder/userfiles/files/42166059657.pdf
• https://karapinarinsaat.net/userfiles/upload/file/21555658395.pdf
• https://www.prestigeautobody.com.au/wp-content/plugins/super-forms/uploads/php/files/263e7c07ff8fe76399a956f647b6296f/77896817460.pdf
• https://estigotours.com/wp-content/plugins/super-forms/uploads/php/files/dd71677b9e83f1beaf11cda44b59a474/59549353814.pdf
• https://kaktutzhit.by/uploads/files/muwabarupezeseroxedutipa.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• wastran.ru
• fertilityupdates.com
• mlead.net
• score1forspencer.com
• realimpacto.com.br
• remontnoedelo.ru
• yuktiedu.com
• lcd96.ru
• imagespa.mx
• www.oknookna.pl
• balajitutorial.com
• hoffmanowska.pl
• color-gateway.com
• osikovo.eu
• claudiodauelsberg.com.br
• asharfilalkulfi.com
• karapinarinsaat.net
• www.prestigeautobody.com.au
• estigotours.com
• www.w3.org
• purl.org
• ns.adobe.com
• stepasidemedical.ie
• kaktutzhit.by

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report