MALICIOUS — futoninupiz.pdf

MALICIOUS — futoninupiz.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: c92e73fb5cb0333dbbdf6c4b35932e84930cf094d217488911facba726716812
• SHA-1: 6557efb36f2344928d9dec30e7ec1dc6c2227153
• MD5: 7ed7933bb01bc6cbb5806b7d6dcdbceb
• ssdeep: 1536:B2oCNauJZ2THkUBJAjw56GlQso23UKlcRqamhSjunwZaYI8RW+W9UQOft1yvWcpj:ZYxJ87kEJAQ6zsD3UK6/mAuwZayWMfKT
• TLSH: T1E537BEF36097DD8C724B8B1768EB52ECA58AE2845272E7504188B72CD5FC67EBF00641
• Submitted as: futoninupiz.pdf
• File type: pdf · Size: 75220 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://plusbateria.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cc4cb90236---39727595893.pdf, http://sooclose.eu/upload/File/retupebivolizaf.pdf, https://adiwirawanbali.com/wp-content/plugins/super-forms/uploads/php/files/3cdb3601752e80e85ae6c0fd45e5bed5/patadutatajufebevanali.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/FevRqgeaUVY/uplcv?utm_term=docs+to+pdf+converter+apk
• http://plusbateria.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607cc4cb90236---39727595893.pdf
• http://sooclose.eu/upload/File/retupebivolizaf.pdf
• https://adiwirawanbali.com/wp-content/plugins/super-forms/uploads/php/files/3cdb3601752e80e85ae6c0fd45e5bed5/patadutatajufebevanali.pdf
• http://kingspec.su/wp-content/plugins/super-forms/uploads/php/files/q5rjm12kgumbmf0lq4p0sebof6/luwalaz.pdf
• http://trainternational.in/wp-content/plugins/formcraft/file-upload/server/content/files/1609254dd9833b---rabolubexevefaludit.pdf
• https://broadstripe.com/wp-content/plugins/super-forms/uploads/php/files/90ab270bd040b4ae3b233715ab98ef62/fabegusibubopijapo.pdf
• http://volareinmongolfiera.it/userfiles/files/pimusinevaxigoluxeta.pdf
• http://cnwt.mgo.cool/upfile/files/2021/09/03/mamezipitov.pdf
• http://upnbkk.com/file_media/file_image/file/40149189872.pdf
• http://3qlohas.com/CKEdit/upload/files/jakumam.pdf
• http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160911766599e0---vomanelateladixade.pdf
• https://kvartira-zalog.ru/wp-content/plugins/super-forms/uploads/php/files/afc614c45896599c07dc570ec9ec9624/25247835569.pdf
• http://wksystems.net/HotelEstimator/userfiles/file/vajedusegoruku.pdf
• https://ceccardolj.ro/userfiles/file/4602323025.pdf
• https://forthepeoplegov.com/userfiles/file/firili.pdf
• http://suseefinance.com/userfiles/file/rokebevogokomexotoban.pdf
• http://fsanaq.com/upload/file/2107271609227872511s5gt3occv98.pdf
• http://anoh.net/pds/userfiles/files/80359506936.pdf
• http://f-kcc.jp/user_data/userfiles/files/repol.pdf
• https://www.chauffeur-prive-nice.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16073f52c0fb4d---lewepisopanasale.pdf
• http://gerd-pollak.de/userfiles/file/97392473101.pdf
• http://brno-skoleniridicu.cz/ckfinder/userfiles/files/sofeva.pdf
• https://bloomland.com/sites/bloomland.com/files/72199414884.pdf
• http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/l4gka6dr84lt2lg3qem5kai2c7/5954179407.pdf

Embedded domains

• feedproxy.google.com
• plusbateria.com
• sooclose.eu
• adiwirawanbali.com
• kingspec.su
• trainternational.in
• broadstripe.com
• volareinmongolfiera.it
• upnbkk.com
• 3qlohas.com
• www.1000ena.com
• kvartira-zalog.ru
• wksystems.net
• forthepeoplegov.com
• suseefinance.com
• fsanaq.com
• anoh.net
• f-kcc.jp
• www.chauffeur-prive-nice.fr
• gerd-pollak.de
• bloomland.com
• www.insurancedirectcanada.ca
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report