MALICIOUS — f47f5.pdf
MALICIOUS — f47f5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
22d8a1898ed0a7d5cbfe54fc1ee641ad746aee4a19fa46baa0e2533caf0aa89a - SHA-1:
9160e5f3b3c866789dcb9fcd3ed09e4f44d9d000 - MD5:
7696fcf27722dfde845a0f2880a23d7f - ssdeep:
768:5gGzpDNp1JWue08QLP2jtZ/AMAz8AdgGZDqO/BhnAm+jRJ8BJvaChYFC:6GF5paLlv4dz8AhZOwBhnKjL4tapFC - TLSH:
T1FB329DF704A7ED8C7ACB9F03ADB6285E5489974CA036C374049C732DC4BC6AD6E508A1 - Submitted as: f47f5.pdf
- File type: pdf · Size: 44067 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/rugatu-rugot.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=camille%20melika%20banks, https://netaluzubik.weebly.com/uploads/1/3/0/8/130813777/4e7a50787f.pdf, https://kuromazu.weebly.com/uploads/1/3/2/6/132695519/ribukas_kevasobunekase.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=camille%20melika%20banks
- https://netaluzubik.weebly.com/uploads/1/3/0/8/130813777/4e7a50787f.pdf
- https://kuromazu.weebly.com/uploads/1/3/2/6/132695519/ribukas_kevasobunekase.pdf
- https://ximazula.weebly.com/uploads/1/3/0/7/130738777/kinogubeta_jazuvijedajote_laweburilud.pdf
- https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/rugatu-rugot.pdf
- https://cdn-cms.f-static.net/uploads/4365998/normal_5f893bffb816d.pdf
- https://cdn-cms.f-static.net/uploads/4365539/normal_5f890de7a705b.pdf
- https://nizesuvijeva.weebly.com/uploads/1/3/1/6/131607023/bikalepi.pdf
- https://xojerajap.weebly.com/uploads/1/3/1/3/131384359/gipipamiv.pdf
- https://damijuvik.weebly.com/uploads/1/3/1/3/131381376/duviviligazofaz.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/bisovelemopux_sinafokoka.pdf
- https://uploads.strikinglycdn.com/files/4c03656b-74f7-4d17-9418-54ec2007675a/wekisepepizi.pdf
- https://uploads.strikinglycdn.com/files/a58f140c-1e2d-4086-9404-1508b6f1b22b/jivurebenapefelexu.pdf
- https://poxobavu.weebly.com/uploads/1/3/1/4/131453713/nejulirubu.pdf
- https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/jepadunuxado_papasakikev_wojolil.pdf
- https://xonimitofowe.weebly.com/uploads/1/3/2/6/132682232/188322e805b2b63.pdf
- https://vimiwegom.weebly.com/uploads/1/3/0/7/130775837/zolud.pdf
- https://uploads.strikinglycdn.com/files/3bfcb448-628c-4898-824b-bd44e205a8b5/a_rose_for_emily_study_guide_questions_and_answers.pdf
- https://uploads.strikinglycdn.com/files/01cc16c9-8eb9-4a82-a274-7f2ab1027024/tuvotamosexotad.pdf
- https://uploads.strikinglycdn.com/files/bf3b73fd-d7f1-4bc0-950e-5f14dee9bcc8/reburoxafuzubipil.pdf
- https://uploads.strikinglycdn.com/files/2c1c55ef-acad-49a7-a64a-707c0443bf21/mokobiza.pdf
- https://uploads.strikinglycdn.com/files/4edbb84f-a65b-4c14-8702-71f73fb5f842/25854102981.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- gettraff.ru
- netaluzubik.weebly.com
- kuromazu.weebly.com
- ximazula.weebly.com
- vuxozajuje.weebly.com
- cdn-cms.f-static.net
- nizesuvijeva.weebly.com
- xojerajap.weebly.com
- damijuvik.weebly.com
- dutitujazekap.weebly.com
- uploads.strikinglycdn.com
- poxobavu.weebly.com
- fodezamu.weebly.com
- xonimitofowe.weebly.com
- vimiwegom.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report