MALICIOUS — vurafevikuvuge-matobifiwuzezu-pomox-valijitekotu.pdf

MALICIOUS — vurafevikuvuge-matobifiwuzezu-pomox-valijitekotu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 3852917379c3423e6b65a25dee326518b6285bc8942451dd1ad2e7465987c647
SHA-1: 4ee7728cbbde8910a8bd3a7a9b18ad5dc18688e5
MD5: dd86455b685c8cc4544e34b183a254ee
ssdeep: 768:a5gGzpDFpTUHXdkxwRYwiQT5ClCTet9t4dsAWiQZzpB7xG595yOzXsG58:1GFJpAHtgLtj4dsAWiQPBkP5yc8G58
TLSH: T198329FF35097EC4C7A87DB135EEA255EA486D78862329B6084987B3CC47C7BC7E40960
Submitted as: vurafevikuvuge-matobifiwuzezu-pomox-valijitekotu.pdf
File type: pdf · Size: 47144 bytes
Verdict: malicious (75/100)

Detections (2 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 75/100 is the fusion of 4 weighted signals:

Embedded link rated malicious by URL analysis: https://jemiwuwavaza.weebly.com/uploads/1/3/0/8/130814288/tigosorivibisakoxu.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://cctraff.ru/wb?keyword=engineering%20with%20excel%204th%20edition%20solutions%20manual%20pdf, https://cdn-cms.f-static.net/uploads/4368969/normal_5f87aa85a584c.pdf, https://cdn-cms.f-static.net/uploads/4365655/normal_5f8742c2a245d.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://cctraff.ru/wb?keyword=engineering%20with%20excel%204th%20edition%20solutions%20manual%20pdf
https://cdn-cms.f-static.net/uploads/4368969/normal_5f87aa85a584c.pdf
https://cdn-cms.f-static.net/uploads/4365655/normal_5f8742c2a245d.pdf
https://cdn-cms.f-static.net/uploads/4367312/normal_5f87c6b5cbe3b.pdf
https://cdn-cms.f-static.net/uploads/4369324/normal_5f87b1fc8e651.pdf
https://cdn.shopify.com/s/files/1/0483/4594/0128/files/24179294526.pdf
https://cdn.shopify.com/s/files/1/0482/3180/9176/files/xefuwudodilaregafak.pdf
https://cdn.shopify.com/s/files/1/0437/1048/0533/files/wonebewaf.pdf
https://cdn.shopify.com/s/files/1/0496/6200/1301/files/dajajazuwevafopivozuzimuv.pdf
https://jemiwuwavaza.weebly.com/uploads/1/3/0/8/130814288/tigosorivibisakoxu.pdf
https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/zutilipevozafeguwu.pdf
https://walijogopabo.weebly.com/uploads/1/3/0/7/130776167/da942785a349.pdf
https://lasajiboz.weebly.com/uploads/1/3/1/3/131379041/4019852.pdf
https://gonerogad.weebly.com/uploads/1/3/1/4/131438616/bekukuvave.pdf
https://jabiratunibi.weebly.com/uploads/1/3/2/6/132683422/dozezobibemoj_winenutulejexur_loxukiziguvofa_vufoxokatuz.pdf
https://site-1038743.mozfiles.com/files/1038743/10864285052.pdf
https://site-1042094.mozfiles.com/files/1042094/71035477882.pdf
https://site-1040327.mozfiles.com/files/1040327/38860890961.pdf
https://site-1041381.mozfiles.com/files/1041381/povimap.pdf
https://lipowuripipu.weebly.com/uploads/1/3/1/3/131378852/6179659.pdf
https://turomanusogagi.weebly.com/uploads/1/3/1/4/131453559/2909381.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

cctraff.ru
cdn-cms.f-static.net
cdn.shopify.com
jemiwuwavaza.weebly.com
guwomenod.weebly.com
walijogopabo.weebly.com
lasajiboz.weebly.com
gonerogad.weebly.com
jabiratunibi.weebly.com
site-1038743.mozfiles.com
site-1042094.mozfiles.com
site-1040327.mozfiles.com
site-1041381.mozfiles.com
lipowuripipu.weebly.com
turomanusogagi.weebly.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report