MALICIOUS — mewomosexu.pdf
MALICIOUS — mewomosexu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (71/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
0acda44d82c4361f22fc8b72b7e1538557096d76b078e3b1bafdfc76b69ddf6a - SHA-1:
bf109de189876630c690216760f867f36527fc29 - MD5:
c79cf1d1c622c32abeeb7862b396d6c4 - ssdeep:
768:MgGzpDxpNiDxFRq2IUG6mc5YfbAAwIcwv2tFUY8xrDqBAoJ1D:JGF9pNu5YfQIcwYF38xrDqBASD - TLSH:
T162305CF350A3DE4C7A875F93AEAB159D508AD748A1329B64448C772CC5BC2BC7F009A1 - Submitted as: mewomosexu.pdf
- File type: pdf · Size: 38253 bytes
- Verdict: malicious (71/100)
Detections (2 of 50 engines)
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 71/100 is the fusion of 3 weighted signals:
- Embedded link rated malicious by URL analysis: https://jiwepurojal.weebly.com/uploads/1/3/0/7/130775762/2995731.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=valery%20altamar%20colombia, https://uploads.strikinglycdn.com/files/33f9ae47-aff7-410f-a3ba-825aa47a1087/48097105728.pdf, https://uploads.strikinglycdn.com/files/5aa362af-765e-4a20-9a1c-44055ac85283/vumuzawajaguwuzawoz.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=valery%20altamar%20colombia
- https://uploads.strikinglycdn.com/files/33f9ae47-aff7-410f-a3ba-825aa47a1087/48097105728.pdf
- https://uploads.strikinglycdn.com/files/5aa362af-765e-4a20-9a1c-44055ac85283/vumuzawajaguwuzawoz.pdf
- https://uploads.strikinglycdn.com/files/39e534ae-7d5b-41ec-a186-8dfdb7659e1f/66207874150.pdf
- https://site-1037866.mozfiles.com/files/1037866/govaliserumederovuvu.pdf
- https://site-1042624.mozfiles.com/files/1042624/88316655095.pdf
- https://bibeliki.weebly.com/uploads/1/3/0/7/130738572/24c86.pdf
- https://folarudivol.weebly.com/uploads/1/3/1/8/131871739/2671073.pdf
- https://jiwepurojal.weebly.com/uploads/1/3/0/7/130775762/2995731.pdf
- https://jiwepurojal.weebly.com/uploads/1/3/0/7/130775762/5954b926bf2773.pdf
- https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/gevoderovepiru.pdf
- https://cdn-cms.f-static.net/uploads/4366623/normal_5f873ee443bf2.pdf
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f87a0a1c4e5b.pdf
- https://cdn-cms.f-static.net/uploads/4366008/normal_5f8704e98cd11.pdf
- https://cdn-cms.f-static.net/uploads/4365602/normal_5f8803fb6085e.pdf
- https://uploads.strikinglycdn.com/files/7971cd25-461d-44fc-ac23-5d2ba8fe4960/zapifogirisu.pdf
- https://uploads.strikinglycdn.com/files/19ce5dfb-c150-4e69-953c-684cc265c827/49935905693.pdf
- https://uploads.strikinglycdn.com/files/4ca8a720-4972-423b-8122-774393557c14/damiwaluraguwinofax.pdf
- https://uploads.strikinglycdn.com/files/b06d7578-682e-4725-bf90-c0de9bf8226f/xurevepenuf.pdf
- https://uploads.strikinglycdn.com/files/fa66cf0f-5b88-4928-9039-f3037e698abf/17455118195.pdf
- https://cdn-cms.f-static.net/uploads/4366043/normal_5f86f4fd927d8.pdf
- https://cdn-cms.f-static.net/uploads/4365660/normal_5f8747b5d4595.pdf
- https://cdn-cms.f-static.net/uploads/4367914/normal_5f87a375b6fca.pdf
- https://cdn-cms.f-static.net/uploads/4365638/normal_5f87d19b6623a.pdf
- https://cdn-cms.f-static.net/uploads/4369786/normal_5f87f7aeba84a.pdf
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- site-1037866.mozfiles.com
- site-1042624.mozfiles.com
- bibeliki.weebly.com
- folarudivol.weebly.com
- jiwepurojal.weebly.com
- jawasolasazilem.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report