MALICIOUS — nidirikagazutulosod.pdf

MALICIOUS — nidirikagazutulosod.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: f6137ffcb283528286729b9b246e99dc5e5b6e2aca31fbbd59fe2162c4280b64
• SHA-1: 94336b5701a07058c31008ecd951ec03242a540d
• MD5: e4707fa9fb825cee1785a0a711b8e4e8
• ssdeep: 1536:lNWqI+5y11Jr1dfn0lannkZ9YlsPHtkdn9Cjcf9z4jLuJoS/1W8Hq:nWqNa3n0Ok/mKHtun9fm3uJoS/gF
• TLSH: T1D039E0F72057CC4C6ACBAB5365AA052C949AEB8D5133A34454C4BB9CC8FC37E2E24A51
• Submitted as: nidirikagazutulosod.pdf
• File type: pdf · Size: 90100 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!E4707FA9FB82
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://garglob.ru/uplcv?utm_term=governor+of+poker+3+cheat+engine, https://transmar.biz/ckfinder/userfiles/files/rapekosewese.pdf, https://staffxrecruitment.com/wp-content/plugins/super-forms/uploads/php/files/f3f7c36cefe8b5295461d1ee2d0d102d/jodisizesogatowalevo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://garglob.ru/uplcv?utm_term=governor+of+poker+3+cheat+engine
• https://transmar.biz/ckfinder/userfiles/files/rapekosewese.pdf
• https://staffxrecruitment.com/wp-content/plugins/super-forms/uploads/php/files/f3f7c36cefe8b5295461d1ee2d0d102d/jodisizesogatowalevo.pdf
• http://gostium.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a834a3980ff---18989801747.pdf
• https://earthchartercities.org/wp-content/plugins/formcraft/file-upload/server/content/files/16098e0b78aced---jenofow.pdf
• https://www.bluegreenshouseboats.in/wp-content/plugins/formcraft/file-upload/server/content/files/160c5aca2c1526---23150749770.pdf
• https://laneopx.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a697ce817c---85887737039.pdf
• https://yidinfo.net/wp-content/plugins/super-forms/uploads/php/files/j1fmoosv40puviv4vjcm7mgopu/maletexerigepituv.pdf
• http://sieckultury.pl/wp-content/plugins/super-forms/uploads/php/files/07376a41a7ebd34dc58ded451f305b8d/kukisakub.pdf
• http://opakowania-loga.pl/zdjecia/fotki/file/vetokowiwamubidifibaw.pdf
• https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/ba547fe92f1c9a84ac73a2d1a7285e73/kowowegajodemobokagakul.pdf
• https://getlovebooks.com/wp-content/plugins/super-forms/uploads/php/files/c4e87b1691da7ed0eb45149710d72f2f/61094752710.pdf
• https://webgirls-studio.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e4de11f50f---43472161985.pdf
• https://alshamiltrading.com/alshamilfiles/file/61715645514.pdf
• https://118highschool.am/wp-content/plugins/super-forms/uploads/php/files/105d471247a92f72cc88cdb5fc425186/81967686185.pdf
• http://www.ncstarim.com.tr/wp-content/plugins/super-forms/uploads/php/files/m0a86v3o7deuk1v7hqbshljqa4/misozevevawosedif.pdf
• https://noddy.nu/images/file/20651566915.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• garglob.ru
• transmar.biz
• staffxrecruitment.com
• gostium.com
• earthchartercities.org
• www.bluegreenshouseboats.in
• laneopx.com
• yidinfo.net
• sieckultury.pl
• opakowania-loga.pl
• gift-edu.ru
• getlovebooks.com
• webgirls-studio.com
• alshamiltrading.com
• www.w3.org
• purl.org
• ns.adobe.com
• 118highschool.am
• www.ncstarim.com.tr
• noddy.nu

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report