MALICIOUS — nukuzapewanokawavajo.pdf
MALICIOUS — nukuzapewanokawavajo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ca7dd24ca577d6b5a9a2948955308571279c335fba4ae92144776013fbf9aa21 - SHA-1:
5f2670f1c94dc736423c9f65cbb6235330c01445 - MD5:
a2ccf03b9c66a506a60521ffd13a4779 - ssdeep:
1536:KoSBiSMbMUJ6PAdrB5qaD/fF7lKwgnO+CeWypOlWWxEaGJqmlKxDmYE:FKMb3BzRQw+O+alDEa1mlk0 - TLSH:
T1FF37B0F3209BDD8C778B5F436DAB529DA089E7486562EE804148B53CD1BC5BEBF10640 - Submitted as: nukuzapewanokawavajo.pdf
- File type: pdf · Size: 71177 bytes
- Verdict: malicious (96/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: http://rotarybrescello.it/userfiles/files/zobejufopolixilajobusor.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cructi.ru/uplcv?utm_term=aed+and+cpr, https://izr.fr/files/zegeduji.pdf, http://rotarybrescello.it/userfiles/files/zobejufopolixilajobusor.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cructi.ru/uplcv?utm_term=aed+and+cpr
- https://izr.fr/files/zegeduji.pdf
- http://rotarybrescello.it/userfiles/files/zobejufopolixilajobusor.pdf
- https://manorhair.com/uploads/files/202109102358435075.pdf
- https://deshpanday.com/ckfinder/userfiles/files/4536558905.pdf
- http://cappellastudio.it/userfiles/files/wagutar.pdf
- http://archidaldegan.eu/userfiles/files/nesuwakavop.pdf
- https://www.golddustdental.com/wp-content/plugins/formcraft/file-upload/server/content/files/161457e2a43527---benijowopula.pdf
- http://holland-ex.com/images/blog/file/soveleboge.pdf
- http://xn--oy2b9bv81anouola.com/upload/file/202109190422114691.pdf
- https://mlspoland.co/files/file/89050779797.pdf
- http://www.frank-diagn.hu/userfiles/files/visogapivewelaniroxu.pdf
- https://centaur.vri.cz/docs/files/42155199563.pdf
- http://njbeihang.com/uploadfile/file///2021090503194423.pdf
- http://stopguepes72.fr/userfiles/file/55442185632.pdf
- https://limsurempat.com/contents/files/xurik.pdf
- https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/1613c7ba3a204b---34605724166.pdf
- https://vdbergelectro.nl/wp-content/plugins/super-forms/uploads/php/files/7c69af5e93a2347b498a558a06955e8a/tavedevabetev.pdf
- https://aokman-drive.com/d/files/94104322482.pdf
- http://caycanh.vn/images/fck/file/pexuginumam.pdf
- https://mamproducciones.es/wp-content/plugins/formcraft/file-upload/server/content/files/1613e2e9ff41f4---gomon.pdf
- https://longhoang.vn/upload/files/70971254400.pdf
- http://zagazzo.com/userfiles/file/dopazifujumani.pdf
- http://srividyaastrology.com/userfiles/file/dewidirokewomaginozalo.pdf
- http://www.meglobalinc.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16140fd352cfbf---501849461.pdf
Embedded domains
- cructi.ru
- izr.fr
- rotarybrescello.it
- manorhair.com
- deshpanday.com
- cappellastudio.it
- archidaldegan.eu
- www.golddustdental.com
- holland-ex.com
- xn--oy2b9bv81anouola.com
- mlspoland.co
- njbeihang.com
- stopguepes72.fr
- limsurempat.com
- www.grandeprairie.org
- vdbergelectro.nl
- aokman-drive.com
- mamproducciones.es
- zagazzo.com
- srividyaastrology.com
- www.meglobalinc.co.za
- hinodecoder.com
- belean.pl
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report