MALICIOUS — dirujude.pdf

MALICIOUS — dirujude.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: fe3d66f0f5a26f8f155e903d30ad31793e1c44ca5cef398c9d1232680f5b2413
• SHA-1: 4aece4cb0a27f563ae42ed43050dad936151e283
• MD5: 2ea8cbbb573d9cf22159ba11b297e58b
• ssdeep: 1536:jQ9y+Om9LO6bfHAK7h4FmWIROXPdgq3WcVP66NWspORjsEqUKB:2NLOafT7OuOld566URINd
• TLSH: T15F38DFF361DBDC8C77878B432AB710A4908AD7C42671EB60844DBBACD6BC5BD6E00950
• Submitted as: dirujude.pdf
• File type: pdf · Size: 83032 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://ketchas.ru/uplcv?utm_term=webos+lg+kodi, http://elverum-revmatiker.no/images/file/wisibamulimazudew.pdf, https://maxlinder.com/admin/assets/ckfinder/userfiles/files/59827836019.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ketchas.ru/uplcv?utm_term=webos+lg+kodi
• http://elverum-revmatiker.no/images/file/wisibamulimazudew.pdf
• https://maxlinder.com/admin/assets/ckfinder/userfiles/files/59827836019.pdf
• http://dangkyidol.com/wp-content/plugins/super-forms/uploads/php/files/8niiu5lfq4vstpoqin5o3o2kgr/93265215114.pdf
• https://kalitelivideoizle.com/resimler/files/rojosurewesug.pdf
• https://zifu-tech.com/app/webroot/userfiles/files/xizesu.pdf
• http://pomocnaukowa.net/Upload/file/xegapurenadigebanusesixe.pdf
• http://noospc.ru/SITE/files/editor/file/wuxodejirusegifubof.pdf
• http://lifestyleufa.ru/wp-content/plugins/super-forms/uploads/php/files/945aa6a0b2f4348bbb46626c6575eb6e/nikuko.pdf
• http://stellar.ru/ckfinder/userfiles/files/temiwiwofelarenuwe.pdf
• http://mmbc.cz/_data/user_files/file/54879289921.pdf
• http://dlzj.net/upload/files/20210905040537831754.pdf
• http://vstarmp.cn/upload/files/20210907_144752.pdf
• http://yyfxsw.com/upload/files/348405325.pdf
• http://fractinvest.com/uploads/file/gadivusorupifemiw.pdf
• http://yuqiaohome.com/uploads/files/202109100155181641.pdf
• http://bahtiyardishekimi.com/fckfiles/file/38171841.pdf
• https://nls.vn/upload/files/janebego.pdf
• https://www.igescanada.com/ckfinder/userfiles/files/juzufamilewekak.pdf
• http://ulv-fogger.es/d/files/koguziponafataxaf.pdf
• https://apsco.ly/userfiles/files/noxidovaposigigasilonej.pdf
• https://sodigital.it/wp-content/plugins/formcraft/file-upload/server/content/files/1613613ce9f267---kikafore.pdf
• http://jsushibrea.com/uploads/files/39286997181.pdf
• http://gazomotor.com/allinone/file/lazofukiwun.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

• ketchas.ru
• elverum-revmatiker.no
• maxlinder.com
• dangkyidol.com
• kalitelivideoizle.com
• zifu-tech.com
• pomocnaukowa.net
• noospc.ru
• lifestyleufa.ru
• stellar.ru
• dlzj.net
• vstarmp.cn
• yyfxsw.com
• fractinvest.com
• yuqiaohome.com
• bahtiyardishekimi.com
• www.igescanada.com
• ulv-fogger.es
• apsco.ly
• sodigital.it
• jsushibrea.com
• gazomotor.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report