MALICIOUS — dejidas.pdf

MALICIOUS — dejidas.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: f2cf5286db08aeca47483c772c3f58ef5f4b2c58bc0b5161849fe2a82acf2b90
• SHA-1: f25b114924e6212b96db1dfa1571e2d13157bde1
• MD5: ae3ad44dd30dc8b6d2b523a9c78f9d25
• ssdeep: 1536:2iyvghVEfW6Ych2xROiYN2WyZiWCpOViIWjSqLNxQSpM5:7yv6Vt6hILEN2WyZ/ViDLNN0
• TLSH: T1F238CFE3A15BCE5C76C79B0369F611A9654BE7C42573DA6080C8B72CD4BC67DBE00980
• Submitted as: dejidas.pdf
• File type: pdf · Size: 76828 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://krisoc.ru/uplcv?utm_term=forraje+verde+hidroponico+cebada+pdf, https://n95america.com/wp-content/plugins/super-forms/uploads/php/files/0f83e2b637e3130476289b355cbb8b61/57530454270.pdf, http://hifitness.hu/userfiles/file/94488007603.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://krisoc.ru/uplcv?utm_term=forraje+verde+hidroponico+cebada+pdf
• https://n95america.com/wp-content/plugins/super-forms/uploads/php/files/0f83e2b637e3130476289b355cbb8b61/57530454270.pdf
• http://hifitness.hu/userfiles/file/94488007603.pdf
• http://stphilomenaonline.org/userfiles/file/jabebitawowifimokiju.pdf
• http://donghotam.com/luutru/files/13693926884.pdf
• https://growyourmoney.in/userfiles/files/82176847905.pdf
• http://dkkarsin.pl/img/upload/files/semolaxor.pdf
• https://dispomydeal.com/wp-content/plugins/super-forms/uploads/php/files/f7c1f4bec52f0aa85a4fc74901fcbc19/favopisikolixizo.pdf
• http://www.trimbleexpress.sk/wp-content/plugins/formcraft/file-upload/server/content/files/16089aa34e561a---zuvorumukefoxugeli.pdf
• http://kraljicabih.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b9cc1b289d0---5489587691.pdf
• http://luckdidea.com/ckfinder/images_store/files/40127818660.pdf
• https://omomediacion.com/wp-content/plugins/super-forms/uploads/php/files/349e90dbf4cb457cfce22c96adc987f5/tosabilolafepaf.pdf
• https://takarasushimn.com/userfiles/files/zegerij.pdf
• http://africansafaris-spain.com/FCKeditor/editor/filemanager/connectors/php/connector.php?Command=FileUpload&Type=File&CurrentFolder=%2Ffile/45515758348.pdf
• https://hotelpancharatna.com/assets/userfiles/files/fogexagoporogurik.pdf
• https://performanceltg.com/wp-content/plugins/super-forms/uploads/php/files/985bed98658b2e0781f481947a6bdaad/92747414836.pdf
• http://104.156.58.56/~web2inbox/wp-content/plugins/formcraft/file-upload/server/content/files/1608fb1c5d3a17---67344774831.pdf
• http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a7a5e77f6c0---95586679503.pdf
• https://inoxquochoang.com/app/webroot/files/images/pages/files/92406238024.pdf
• http://www.megasaludips.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d06aad832e---minerururudasavesof.pdf
• http://clean-ecology.com/Upload/files/zoseronij.pdf
• http://curry-box-deluxe.de/userfiles/file/48389199065.pdf
• http://autobedrijvenindex.nl/images/uploads/sorefejukoz.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/

Embedded domains

• krisoc.ru
• n95america.com
• stphilomenaonline.org
• donghotam.com
• growyourmoney.in
• dkkarsin.pl
• dispomydeal.com
• kraljicabih.com
• luckdidea.com
• omomediacion.com
• takarasushimn.com
• africansafaris-spain.com
• hotelpancharatna.com
• performanceltg.com
• kaufdeinauto.de
• inoxquochoang.com
• www.megasaludips.com
• clean-ecology.com
• curry-box-deluxe.de
• autobedrijvenindex.nl
• www.w3.org
• purl.org
• ns.adobe.com
• hifitness.hu
• www.trimbleexpress.sk

Embedded IP addresses

• 104.156.58.56

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report