MALICIOUS — fimumu.pdf
MALICIOUS — fimumu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.
Identification
- SHA-256:
ef228f174c49cad7c6afc7a1738743719db716f1067f3c04cd94cab5be9c985e - SHA-1:
292c86f5dc9880b570a9606d261e2e3d24092e4f - MD5:
187a519bce431abae75af4d1cb7e6672 - ssdeep:
1536:f5D1mLw6KACKIEPYxVn7Ylc/TfgOmGpGt99PB+iipE4bA15lQo:BkLw6KACWATKBNt99EE4bA151 - TLSH:
T11038C0F7005BDD8CB71B5B53AD7615A9B49AD399A072BB9040D8BB1DC4BC27E3E10900 - Submitted as: fimumu.pdf
- File type: pdf · Size: 77233 bytes
- Verdict: malicious (92/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!187A519BCE43
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://dugedepap.ru/wb?keyword=is%202006%20honda%20odyssey%20a%20good%20car, https://cdn-cms.f-static.net/uploads/4459177/normal_5fe8e43862ef7.pdf, https://cdn-cms.f-static.net/uploads/4409257/normal_6041aba18d7e7.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://dugedepap.ru/wb?keyword=is%202006%20honda%20odyssey%20a%20good%20car
- https://cdn-cms.f-static.net/uploads/4459177/normal_5fe8e43862ef7.pdf
- https://cdn-cms.f-static.net/uploads/4409257/normal_6041aba18d7e7.pdf
- https://cdn-cms.f-static.net/uploads/4393016/normal_60232b3547fca.pdf
- http://mujebik.atwebpages.com/38119038370.pdf
- http://luwemazezabubat.rf.gd/zameridejajimabutolu.pdf
- https://nesajejegumexe.weebly.com/uploads/1/3/0/7/130776687/makerofowipuzom.pdf
- http://fexajorijoworas.epizy.com/66860440694.pdf
- https://static.s123-cdn-static.com/uploads/4426571/normal_5fdd91e4796c8.pdf
- http://bifovigavij.myartsonline.com/cuisinart_ss-700_parts_diagram.pdf
- http://bedigetulo.epizy.com/nobupajivokijafe.pdf
- https://gulezawajure.weebly.com/uploads/1/3/1/8/131858287/9504876.pdf
- http://modezewop.mygamesonline.org/33303666527.pdf
- https://rifuxegu.weebly.com/uploads/1/3/4/5/134525143/jofujapopurus.pdf
- https://uploads.strikinglycdn.com/files/be032be2-d4c6-4a9d-9639-34af89e24b00/bebokuvosavatiradivaxe.pdf
- http://rosevasejila.myartsonline.com/chuunibyou_demo_koi_ga_shitai_characters.pdf
- http://itash.space/dofadurofulupirzue5r.pdf
- https://uploads.strikinglycdn.com/files/e56ea347-afd5-448d-8c5e-d4deba8374ab/valuvufanuripelumufisefot.pdf
- http://saudiautoinsurance.com/12868652669o96pp.pdf
- http://ig-copyrightnotice.com/menezurawefwq4wg.pdf
- http://sosyaltakipcipanelin.com/tikirurubelitovakutuuxtw2.pdf
- http://kakununul.epizy.com/98629475732.pdf
- http://xirozaza.onlinewebshop.net/rofapewipu.pdf
- http://help-lnstagramcopyrights-verify.com/29745467057b3zf5.pdf
- http://vololotiwu.rf.gd/33312822243.pdf
Embedded domains
- dugedepap.ru
- cdn-cms.f-static.net
- mujebik.atwebpages.com
- nesajejegumexe.weebly.com
- fexajorijoworas.epizy.com
- static.s123-cdn-static.com
- bifovigavij.myartsonline.com
- bedigetulo.epizy.com
- gulezawajure.weebly.com
- modezewop.mygamesonline.org
- rifuxegu.weebly.com
- uploads.strikinglycdn.com
- rosevasejila.myartsonline.com
- itash.space
- saudiautoinsurance.com
- ig-copyrightnotice.com
- sosyaltakipcipanelin.com
- kakununul.epizy.com
- xirozaza.onlinewebshop.net
- help-lnstagramcopyrights-verify.com
- www.w3.org
- purl.org
- ns.adobe.com
- luwemazezabubat.rf.gd
- vololotiwu.rf.gd
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report