MALICIOUS — nuvimavuruzinegegumu.pdf

MALICIOUS — nuvimavuruzinegegumu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: c2e54876a5361d47ddaeefff028ab63e557db56fd733491e7a32d0b093f97082
• SHA-1: bb109d7bd0e3f254a927ca39da26ddc1680cad97
• MD5: 2606b945b4c38fa5ae230f167e1cd810
• ssdeep: 1536:ix4ue4Xlg64uQW61L0a5jx3z386zPDUT9dT3eatCUx7wWY:iyue4r4ua0af3z380PYTDT3eatCiO
• TLSH: T16437BFF354D7DE9C7E8A5B03AEA7416C118ED389323AC7A0408CBA5DD4BCA6E7D10950
• Submitted as: nuvimavuruzinegegumu.pdf
• File type: pdf · Size: 70857 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!2606B945B4C3
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://kuzutuzo.ru/strik?utm_term=roomba+870+parts, https://uploads.strikinglycdn.com/files/1e27e3aa-acc2-4677-b4f9-1a7db2b9a2b0/black_history_books_for_high_school_students.pdf, https://uploads.strikinglycdn.com/files/b2ca455e-cf2e-4c5f-96ed-51904251966b/16506712015.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://kuzutuzo.ru/strik?utm_term=roomba+870+parts
• https://uploads.strikinglycdn.com/files/1e27e3aa-acc2-4677-b4f9-1a7db2b9a2b0/black_history_books_for_high_school_students.pdf
• https://uploads.strikinglycdn.com/files/b2ca455e-cf2e-4c5f-96ed-51904251966b/16506712015.pdf
• http://japinoxizidunub.myartsonline.com/majevixodagixotipurus.pdf
• https://uploads.strikinglycdn.com/files/2e866a27-708c-4ce1-b3a0-fa19e0506502/rita_mulcahy_pmp_exam_prep.pdf
• https://uploads.strikinglycdn.com/files/3a072b76-003c-4bd4-ab57-cf405b5f0d8a/kepudoposafepibedufak.pdf
• http://ziduzuraxiralet.iblogger.org/lattice_energy_calculation.pdf
• https://uploads.strikinglycdn.com/files/5708d42a-278c-49ac-8414-26bc921440af/23791946788.pdf
• http://neliwiveles.22web.org/sisupobo.pdf
• https://uploads.strikinglycdn.com/files/343df4fe-70c5-4b06-8c85-eb24b017048e/63812569228.pdf
• http://nejupike.mygamesonline.org/21032047516.pdf
• https://uploads.strikinglycdn.com/files/36544d3e-95c9-40a5-a675-fb2a77273b2b/did_they_stop_making_games_for_ps_vita.pdf
• https://uploads.strikinglycdn.com/files/aa10c0da-5111-4aa7-8c34-fbf3727bcc0a/zodijinakewokibubitojudo.pdf
• https://uploads.strikinglycdn.com/files/852926f1-3ba1-48cf-844e-3e432606d877/90806218095.pdf
• https://uploads.strikinglycdn.com/files/bde02408-ac46-4e0c-a5eb-1a96797b1d5a/21515978458.pdf
• https://uploads.strikinglycdn.com/files/2d292595-272a-4c5a-a14c-de01ffa5dca1/vopuze.pdf
• http://jixenefotudak.epizy.com/zebekonewosojejo.pdf
• https://uploads.strikinglycdn.com/files/fd04d815-2eae-4703-a740-97b2a5f6bc6d/yaesu_ft-7800_for_sale.pdf
• http://towonededuv.medianewsonline.com/kiwalanomelosalone.pdf
• http://fewudutizoxom.medianewsonline.com/rodune.pdf
• https://uploads.strikinglycdn.com/files/4dd963c5-de2c-48d6-8506-253a7dacb195/72154058126.pdf
• https://uploads.strikinglycdn.com/files/7689ad69-bf24-4bb7-ae8d-e6fee3d5b775/47559849356.pdf
• https://uploads.strikinglycdn.com/files/754781b1-2a52-40a4-8136-edc45aa056bd/8275542294.pdf
• https://uploads.strikinglycdn.com/files/be8a6510-c657-4085-80ed-b19143b2c0f1/que_lleva_un_proyecto_de_investigacion.pdf
• http://binuxusegewake.epizy.com/how_much_does_scouts_cost_south_africa.pdf

Embedded domains

• kuzutuzo.ru
• uploads.strikinglycdn.com
• japinoxizidunub.myartsonline.com
• ziduzuraxiralet.iblogger.org
• neliwiveles.22web.org
• nejupike.mygamesonline.org
• jixenefotudak.epizy.com
• towonededuv.medianewsonline.com
• fewudutizoxom.medianewsonline.com
• binuxusegewake.epizy.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report