MALICIOUS — mejetilemuv.pdf

MALICIOUS — mejetilemuv.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: efa47b0be791d5648d93192ecc602b41206129834664d862500c0699ac5e4662
• SHA-1: be2ed5a28ea1d16a17280e86b9df4ee2c7c33cf8
• MD5: 57f2b761b22a73d9c06a0db7b23d9c07
• ssdeep: 1536:e+LOE8CfSR9Ivf28uLCqisUu2ODWEvJXB5QvhArAW+eQ0lP4WGBB:XOLWS/IGTJ37zDTxXB5QJArAW0nWK
• TLSH: T17538E1F3614BEE8C768B9B5369F6147C2087CA491636EA940884FA6CC57CF7E7E40910
• Submitted as: mejetilemuv.pdf
• File type: pdf · Size: 81108 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!57F2B761B22A
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://irlanc.ru/uplcv?utm_term=in+ice+cold+blood+season+1+episode+3, https://miamivanservice.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b08aaa8ea2a---jipupexutawununijopuxato.pdf, http://www.bestlifepolicy.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16087da490acd8---85647896369.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://irlanc.ru/uplcv?utm_term=in+ice+cold+blood+season+1+episode+3
• https://miamivanservice.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b08aaa8ea2a---jipupexutawununijopuxato.pdf
• http://www.bestlifepolicy.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16087da490acd8---85647896369.pdf
• http://for-rent-aalst.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609f55758e8ad---39361261786.pdf
• https://www.blackandwhite-salon.com/wp-content/plugins/super-forms/uploads/php/files/20ebd45d9110b582be996cfe62f8eb54/55880502508.pdf
• https://www.urban-quartz.co.uk/wp-content/plugins/super-forms/uploads/php/files/74bd8e633b259575414cc44f01c802b5/tawavizolejomamadaz.pdf
• http://www.farparts.cl/wp-content/plugins/formcraft/file-upload/server/content/files/160afd08932f03---34372312205.pdf
• https://samsungvrvklima.com/upload/ckfinder/files/zezubikinimemerutuwodavu.pdf
• https://attack.lt/images/files/44048052435.pdf
• http://dodici12.ru/wp-content/plugins/super-forms/uploads/php/files/pj20r0uetv4op6bs2u3icbapc3/disiladonuloti.pdf
• http://www.inhd.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160827670eebdb---penusodijibajiruduzene.pdf
• https://stpetejazz.com/wp-content/plugins/super-forms/uploads/php/files/733vc8oqtffakvmbouseuoea55/golezo.pdf
• https://cedarcreeksauce.com/wp-content/plugins/super-forms/uploads/php/files/c6a594e11544bc7c7a8cfbde46308900/nudujatupirer.pdf
• https://vuaship.com/wp-content/plugins/super-forms/uploads/php/files/vjvejcr8ol2lrgccnism16b5p5/goguzebexat.pdf
• https://sipsib.ru/wp-content/plugins/super-forms/uploads/php/files/0ba77ef5b2623e606a672d530426a2a8/rerazefuvadexudupizireda.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• irlanc.ru
• miamivanservice.net
• www.bestlifepolicy.co.uk
• for-rent-aalst.com
• www.blackandwhite-salon.com
• www.urban-quartz.co.uk
• samsungvrvklima.com
• dodici12.ru
• www.inhd.com.br
• stpetejazz.com
• cedarcreeksauce.com
• vuaship.com
• sipsib.ru
• www.w3.org
• purl.org
• ns.adobe.com
• www.farparts.cl
• attack.lt

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report