MALICIOUS — xedos.pdf

MALICIOUS — xedos.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: d8dab47755661513be0da6281fccb20bb32dd7eb53c162da43cc8666332461fa
• SHA-1: 25476e7f3400962d837103fb954966b7d3b616ca
• MD5: 2c5d6aed47845f566eb0615f2e5ffcf3
• ssdeep: 1536:atolWfMSFjboXinUac+rngSMWW5NjX1wW6pOu2zxVd3Irhu:+dMSFjboXinW+rngSM5jlZu2d3II
• TLSH: T16337BFF3219BCE8C7A578F8378E7115D948AD3482563EB604088B76CD4BC9BDAF44A40
• Submitted as: xedos.pdf
• File type: pdf · Size: 70843 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://rougezenekar.hu/files/file/16022720741.pdf, http://esenkardeslerinsaat.com/resimlerfiles/nizijo.pdf, http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614661fd51484---29699781622.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/skout/mBVl/~3/FevRqgeaUVY/uplcv?utm_term=analysis+of+the+applicant+by+sylvia+plath
• https://rougezenekar.hu/files/file/16022720741.pdf
• http://esenkardeslerinsaat.com/resimlerfiles/nizijo.pdf
• http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614661fd51484---29699781622.pdf
• http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16156d1dd56fc9---dibiramujalejufe.pdf
• http://dges.in/userfiles/file/nofonefilakiwulaku.pdf
• https://lifesmart.ro/ckfinder/userfiles/files/dixufikovuwus.pdf
• http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614ebcd548be0---43125057986.pdf
• http://archiw.bibliotekalesmierz.eu/img/upload/files/bukatimuvajowofulox.pdf
• http://hocomesun.com/upload/fuwagebofisowafo.pdf
• http://medwin.kr/userData/board/file/sapawizafur.pdf
• http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/161431e92f011a---77779618105.pdf
• http://lachambredechos.com/userfiles/file/47343215512.pdf
• http://baheth24cars.com/ckfinder/userfiles/files/wodazi.pdf
• http://www.vandiestbrandstoffen.be/uploads/files/28852798455.pdf
• http://186086.com/upload/files/lipamezemugupokefigega.pdf
• http://pnmanagementsolutions.in/uploads/74001397817.pdf
• http://fotocaroli.it/userfiles/files/59420461326.pdf
• https://decoveinvestment.com/userfiles/file/21066143561.pdf
• http://pomelieagency.com/userfiles/files/kudodisozexur.pdf
• https://ecableapp.com/FCKeditor/FCKimgUpload/file/fupabexogezifagirup.pdf
• http://macautemple.com/userfiles/file/juloj.pdf
• http://hiniceshine.com/upload/28051897525.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/

Embedded domains

• feedproxy.google.com
• esenkardeslerinsaat.com
• artmetinc.com
• ontheedgeofnow.com
• dges.in
• totaleclipsenv.com
• archiw.bibliotekalesmierz.eu
• hocomesun.com
• medwin.kr
• www.movingintofreedom.com
• lachambredechos.com
• baheth24cars.com
• www.vandiestbrandstoffen.be
• 186086.com
• pnmanagementsolutions.in
• fotocaroli.it
• decoveinvestment.com
• pomelieagency.com
• ecableapp.com
• macautemple.com
• hiniceshine.com
• www.w3.org
• purl.org
• ns.adobe.com
• rougezenekar.hu

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report