MALICIOUS — fegobepederitawu.pdf

MALICIOUS — fegobepederitawu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: da8b9543947abb727bc00be295fd517b7743887a1927ca660b29de54e851d4c4
• SHA-1: debf950b90c18f96474302a850dd7b7400e9693a
• MD5: 10a9d7d073dd64a75bc7da41ca603321
• ssdeep: 1536:yhJmTNIn3qfR6C1vcdN7nOwBRF5fpquYRPZzDcj5m+M8t:yZ6ETOwLF5xJkhtu
• TLSH: T17038D0F3128BEECC7A8BDF5356AA12AD7589C6492132D66424C8F32CC47C67E6F14910
• Submitted as: fegobepederitawu.pdf
• File type: pdf · Size: 81881 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!10A9D7D073DD
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/3a768f692dc7f6ea913073983d182859/megipelutukuvazuwupoxemaf.pdf, https://www.cukoyem.com.tr/wp-content/plugins/super-forms/uploads/php/files/mm075ph4vmlfd5hjaomcf660t4/77047923180.pdf, http://nakatka.com/files/file/56951112114.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=how+to+set+up+airprint+on+ipad+pro
• https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/3a768f692dc7f6ea913073983d182859/megipelutukuvazuwupoxemaf.pdf
• https://www.cukoyem.com.tr/wp-content/plugins/super-forms/uploads/php/files/mm075ph4vmlfd5hjaomcf660t4/77047923180.pdf
• http://nakatka.com/files/file/56951112114.pdf
• https://perfecthospital.org/FCKeditor/file/29698823951.pdf
• https://www.chortho.co.uk/wp-content/plugins/super-forms/uploads/php/files/kdkbn86i0mp379fqiiapu9ejae/27190490976.pdf
• http://www.platformliften.info/wp-content/plugins/formcraft/file-upload/server/content/files/160c5e162c3e94---511363715.pdf
• http://originalcheck.it/public/img_admin/file/%5C/46524021788.pdf
• http://in-dapt.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a1721e1e4e---46549891905.pdf
• http://9meclinic.com/ckfinder/userfiles/files/xagibidedorosopudusopulek.pdf
• https://lakeshoresmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/88rhn7skkrn4e5pauc3sohegj5/68273005553.pdf
• http://africansafaris-spain.com/FCKeditor/editor/filemanager/connectors/php/connector.php?Command=FileUpload&Type=File&CurrentFolder=%252Ffile/boxutumumixurivupasoru.pdf
• https://coil.hk/upload/files/30353240901.pdf
• https://harpethvalleyhealth.com/wp-content/plugins/super-forms/uploads/php/files/0f181f4d60b3c336e05db647ae2a4e70/86737022537.pdf
• https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/114d3d068d092084cde73524236f77db/futeda.pdf
• http://robalton.es/Albums/images/file/%5C/bodadazidugitun.pdf
• https://www.c2commercial.com/wp-content/plugins/super-forms/uploads/php/files/c99e76f4c96d0edb2d2147077c6bbffc/jorabaj.pdf
• https://sportsht.com/userfiles/file/ledoximoduburixosimamuv.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• feedproxy.google.com
• www.dynasil.com
• nakatka.com
• perfecthospital.org
• www.chortho.co.uk
• www.platformliften.info
• originalcheck.it
• in-dapt.com
• 9meclinic.com
• lakeshoresmilesdentistry.com
• africansafaris-spain.com
• coil.hk
• harpethvalleyhealth.com
• 3dreamstudios.com
• robalton.es
• www.c2commercial.com
• sportsht.com
• www.w3.org
• purl.org
• ns.adobe.com
• www.cukoyem.com.tr

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report