MALICIOUS — 9172357.pdf
MALICIOUS — 9172357.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
08edf54bcb7d47237cf8bc3f994940232c58196d2de47362b50b4417681af773 - SHA-1:
dcac17042620de9bcd42e48cdebdd75d77c4b86f - MD5:
3e08a5d813211cdeda932894be198374 - ssdeep:
768:AgGzpDkp2lAjWPyaJHWaQQuW4sgq6A1nCUlRJsmQq98V0TpQ2msa8h:NGFwp2Br5WK4pL4flRh2V28sa8h - TLSH:
T168326BF30053ED8C7ACF5B839EAB159D608AC389713693904188B72DC57CAED6F00A65 - Submitted as: 9172357.pdf
- File type: pdf · Size: 45544 bytes
- Verdict: malicious (75/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://gejatovuri.weebly.com/uploads/1/3/1/4/131406669/xipabedoxu_winirumuji.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=globaliza%C3%A7%C3%A3o%20e%20capitalismo%20pdf, https://fomomeku.weebly.com/uploads/1/3/2/7/132712435/3546827.pdf, https://jugoruzaja.weebly.com/uploads/1/3/1/4/131407370/4647236.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=globaliza%C3%A7%C3%A3o%20e%20capitalismo%20pdf
- https://fomomeku.weebly.com/uploads/1/3/2/7/132712435/3546827.pdf
- https://jugoruzaja.weebly.com/uploads/1/3/1/4/131407370/4647236.pdf
- https://folarudivol.weebly.com/uploads/1/3/1/8/131871739/lobuluwesuvikekojixa.pdf
- https://gejatovuri.weebly.com/uploads/1/3/1/4/131406669/xipabedoxu_winirumuji.pdf
- https://lixaworone.weebly.com/uploads/1/3/1/8/131871871/domivine.pdf
- https://uploads.strikinglycdn.com/files/54aa21f7-590a-4644-8f77-402fc27ccca4/xenebopoz.pdf
- https://uploads.strikinglycdn.com/files/36c7259e-45ab-4689-8023-9c4f062acedf/wojerikevipipupugekagiget.pdf
- https://uploads.strikinglycdn.com/files/008d0d69-d704-4807-808a-2d5e99bd7239/falizixijilu.pdf
- https://uploads.strikinglycdn.com/files/6dd5851f-5e74-45f0-9268-4eb894ade12d/53596893527.pdf
- https://uploads.strikinglycdn.com/files/1d2fec30-56a4-4e91-aa93-0c653c998ba7/dark_neighborhood_game.pdf
- https://uploads.strikinglycdn.com/files/da78a480-6d9d-4fab-817b-102dded2e046/93735620.pdf
- https://uploads.strikinglycdn.com/files/48c13651-add6-4f31-a239-5598332d4bc3/90717380455.pdf
- https://uploads.strikinglycdn.com/files/fefca84d-40fc-4d20-86ca-4454d43cf319/electricity_and_magnetism_purcell_so.pdf
- https://uploads.strikinglycdn.com/files/2680e32b-4f7c-45af-b1b6-48a3ecd9c2ae/tonipajiror.pdf
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/5d6f2da.pdf
- https://tavumake.weebly.com/uploads/1/3/2/7/132740551/fafajaxunej_fifuxosuw_jilapowebemibi_rabadu.pdf
- https://mogidudurunupiz.weebly.com/uploads/1/3/2/6/132695636/warudogi-jutuki-baboxivux-xumatirogik.pdf
- https://molisemopum.weebly.com/uploads/1/3/1/4/131437834/memuwom-jegajavupikunaw-sawola.pdf
- https://nikuwexipamojag.weebly.com/uploads/1/3/0/8/130813731/gamiduv.pdf
- https://s3.amazonaws.com/daraniwekamidir/793797328.pdf
- https://s3.amazonaws.com/xesigeze/33622911807.pdf
- https://s3.amazonaws.com/vinivuxo/watermark_app.pdf
- https://s3.amazonaws.com/tixedujegibex/7812_voltage_regulator.pdf
- https://s3.amazonaws.com/figugipopar/fefewufiweterixivuli.pdf
Embedded domains
- cctraff.ru
- fomomeku.weebly.com
- jugoruzaja.weebly.com
- folarudivol.weebly.com
- gejatovuri.weebly.com
- lixaworone.weebly.com
- uploads.strikinglycdn.com
- keniwuki.weebly.com
- tavumake.weebly.com
- mogidudurunupiz.weebly.com
- molisemopum.weebly.com
- nikuwexipamojag.weebly.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report