MALICIOUS — wedokemizomeporutop.pdf
MALICIOUS — wedokemizomeporutop.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (71/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
256d4b4bc94e00476852e61b5ff0e4ec3b08e91c071331835a01596c80ca8769 - SHA-1:
b5bec85892fc92c8a2404c985f9c019eebde0c16 - MD5:
44fc54f059801c82df41c3081a81a7cd - ssdeep:
768:/gGzpDUZZfcPgrEZAa2u/1mQ9shoYG4y9gN/RHFQq:IGFoT4A61mtKaN/FFQq - TLSH:
T1F2304AF3519BDE8C7AC7CB036EAB385D518AD74C6132A7605498A62CC5BC37D7E40A20 - Submitted as: wedokemizomeporutop.pdf
- File type: pdf · Size: 39134 bytes
- Verdict: malicious (71/100)
Detections (2 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
MITRE ATT&CK
Why this verdict
The malicious score of 71/100 is the fusion of 3 weighted signals:
- Embedded link rated malicious by URL analysis: https://pamaridefudeluz.weebly.com/uploads/1/3/0/7/130776324/80775bc.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=driving%20theory%20test%20book%20pdf%20download%20botswana, https://jugubiwujivivej.weebly.com/uploads/1/3/4/3/134352954/surisulese_fapunewaw_kovejaxebufaf_dutaminonix.pdf, https://vaxajiwozoli.weebly.com/uploads/1/3/1/6/131637631/xexewen.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=driving%20theory%20test%20book%20pdf%20download%20botswana
- https://jugubiwujivivej.weebly.com/uploads/1/3/4/3/134352954/surisulese_fapunewaw_kovejaxebufaf_dutaminonix.pdf
- https://vaxajiwozoli.weebly.com/uploads/1/3/1/6/131637631/xexewen.pdf
- https://rijizego.weebly.com/uploads/1/3/0/7/130776487/samuwozasana.pdf
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/gapovowumepekegosiza.pdf
- https://jewajufigojoxi.weebly.com/uploads/1/3/1/4/131438211/a3603.pdf
- https://s3.amazonaws.com/davolazupivowi/unaltered_augsburg_confession.pdf
- https://s3.amazonaws.com/nigimul/algorithms_in_c_robert_sedgewick_github.pdf
- https://s3.amazonaws.com/rimejiguvif/44332933154.pdf
- https://s3.amazonaws.com/fizaxo/tipos_de_cateterismo_vesical.pdf
- https://s3.amazonaws.com/pafiganovavi/91627468477.pdf
- https://pamaridefudeluz.weebly.com/uploads/1/3/0/7/130776324/80775bc.pdf
- https://naxupezo.weebly.com/uploads/1/3/4/3/134350891/gewawekakozelot.pdf
- https://zalawevovupat.weebly.com/uploads/1/3/0/9/130969727/falero-lugomabupu.pdf
- https://bitekiparoduj.weebly.com/uploads/1/3/4/0/134017536/1726140.pdf
- https://damijuvik.weebly.com/uploads/1/3/1/3/131381376/1765889.pdf
- https://sixodajumam.weebly.com/uploads/1/3/4/3/134311071/b60ab52ca7ed2.pdf
- https://jamuseramomuf.weebly.com/uploads/1/3/1/8/131871426/sokora.pdf
- https://viweposedijul.weebly.com/uploads/1/3/1/0/131070314/757a132c443a.pdf
- https://sesorefamasupuv.weebly.com/uploads/1/3/1/0/131071262/ribumaxasarobeduzab.pdf
- https://cdn-cms.f-static.net/uploads/4369777/normal_5f880752db521.pdf
- https://cdn-cms.f-static.net/uploads/4366388/normal_5f875a825e876.pdf
- https://cdn-cms.f-static.net/uploads/4365525/normal_5f888f25920f9.pdf
- https://cdn-cms.f-static.net/uploads/4366664/normal_5f877607b9bf4.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- jugubiwujivivej.weebly.com
- vaxajiwozoli.weebly.com
- rijizego.weebly.com
- genigudepa.weebly.com
- jewajufigojoxi.weebly.com
- s3.amazonaws.com
- pamaridefudeluz.weebly.com
- naxupezo.weebly.com
- zalawevovupat.weebly.com
- bitekiparoduj.weebly.com
- damijuvik.weebly.com
- sixodajumam.weebly.com
- jamuseramomuf.weebly.com
- viweposedijul.weebly.com
- sesorefamasupuv.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report