MALICIOUS — savibivikut.pdf
MALICIOUS — savibivikut.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
12f028b241eedba9b330d43731910574981eea3fb109a3fc9f287946b093441a - SHA-1:
00bcdb72712f2709506ac3395330f3a038febbe7 - MD5:
dacf22b7ca6fc780226dde1f20f2e457 - ssdeep:
768:igGzpDFp55VLGo/Ma+vCL+2h1E+yXVaGqBc2YLemyoeHFXxxHV:/GFppBLTRun21yrqS2Y6mjeHFXxxHV - TLSH:
T1AF329EF351E3ED4C7B4AAB232EEB1199914ADA4D603287A0558C6B3CC4F85FD3E10A51 - Submitted as: savibivikut.pdf
- File type: pdf · Size: 44450 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/1000608.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=projection+time+alarm+clock+five+below+instructions, https://site-1043600.mozfiles.com/files/1043600/55947567539.pdf, https://site-1036879.mozfiles.com/files/1036879/mibeduzuwumutelisesupuwi.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/strik?keyword=projection+time+alarm+clock+five+below+instructions
- https://site-1043600.mozfiles.com/files/1043600/55947567539.pdf
- https://site-1036879.mozfiles.com/files/1036879/mibeduzuwumutelisesupuwi.pdf
- https://site-1039316.mozfiles.com/files/1039316/tepevotarow.pdf
- https://site-1043662.mozfiles.com/files/1043662/joxetupafetegokuroritose.pdf
- https://fekudumubaf.weebly.com/uploads/1/3/2/6/132681201/bodajetosason-bipejugibelumar-dupatiror-zabupuzuta.pdf
- https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/1000608.pdf
- https://mogezisatizate.weebly.com/uploads/1/3/0/7/130775403/3922450.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/3808383.pdf
- https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/8276696.pdf
- https://uploads.strikinglycdn.com/files/ab5eda9d-4745-48aa-8d32-3a4ebea164d5/dofureno.pdf
- https://uploads.strikinglycdn.com/files/72f9c65b-aa73-48b5-a899-18c805ca474f/zunagiwez.pdf
- https://uploads.strikinglycdn.com/files/e789a520-9027-4a6f-8665-2e08a77a43ec/geturipimagite.pdf
- https://uploads.strikinglycdn.com/files/9b698eed-e09e-4e7f-990c-708a15e51cac/jotobipaduzufim.pdf
- https://uploads.strikinglycdn.com/files/34e8407d-ebe0-4513-a4ac-c5981609ac93/78120058781.pdf
- https://cdn-cms.f-static.net/uploads/4367005/normal_5f8894df25494.pdf
- https://cdn-cms.f-static.net/uploads/4366654/normal_5f873ca39a357.pdf
- https://kenilajapa.weebly.com/uploads/1/3/1/0/131069910/lojowuzesewat_tuxabikugu_wepapemefik_vizepibodu.pdf
- https://nukevokisoget.weebly.com/uploads/1/3/2/7/132711970/xazumaziz_wafozuzofati.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- site-1043600.mozfiles.com
- site-1036879.mozfiles.com
- site-1039316.mozfiles.com
- site-1043662.mozfiles.com
- fekudumubaf.weebly.com
- fodezamu.weebly.com
- mogezisatizate.weebly.com
- gimejexoxixaza.weebly.com
- jatorogerujew.weebly.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- kenilajapa.weebly.com
- nukevokisoget.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report