MALICIOUS — 2efecb114f5e5.pdf
MALICIOUS — 2efecb114f5e5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
3e696ef440cbab3fc5d115becb8afdb52b69f7e7b30a28678b7503cc1c5d666e - SHA-1:
269d972c813d04050816249bdd66bfbef2cf8f45 - MD5:
d4ea7b26106d42c930563ccf99d5459d - ssdeep:
768:igGzpDEpUofzC97hXEEQkCunARkHJRhYVArh7xKnUAee3MATApIX8pSWs:/GFgpUBscXDhayh76JTASX8sWs - TLSH:
T18E317BF340A7DC4C7A8B9F07AEEB265D514AD389A0329B91058C672CD0BC6ED2F10915 - Submitted as: 2efecb114f5e5.pdf
- File type: pdf · Size: 42901 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://jeponiruwapin.weebly.com/uploads/1/3/0/7/130776483/timafu-wevaxanarewo.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=expectation%20hangover%20audio, https://cdn-cms.f-static.net/uploads/4366031/normal_5f8715547da07.pdf, https://cdn-cms.f-static.net/uploads/4365600/normal_5f8709b36ee47.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=expectation%20hangover%20audio
- https://cdn-cms.f-static.net/uploads/4366031/normal_5f8715547da07.pdf
- https://cdn-cms.f-static.net/uploads/4365600/normal_5f8709b36ee47.pdf
- https://cdn-cms.f-static.net/uploads/4366057/normal_5f86f5528ed6b.pdf
- https://cdn-cms.f-static.net/uploads/4366017/normal_5f8702012a0a8.pdf
- https://cdn-cms.f-static.net/uploads/4365589/normal_5f87217cbcf7f.pdf
- https://jeponiruwapin.weebly.com/uploads/1/3/0/7/130776483/timafu-wevaxanarewo.pdf
- https://fekudumubaf.weebly.com/uploads/1/3/2/6/132681201/2bba1d0.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/b4b3eb38b.pdf
- https://jawowigo.weebly.com/uploads/1/3/0/7/130774982/dolaguvojedubane.pdf
- https://boguvetasitob.weebly.com/uploads/1/3/1/3/131380850/lemebakagur.pdf
- https://uploads.strikinglycdn.com/files/a475cd0d-4033-442e-bc48-cc5c9e63ad22/kodesed.pdf
- https://uploads.strikinglycdn.com/files/7fdb64be-6883-4de3-a9dc-b74373635dcc/40706319271.pdf
- https://uploads.strikinglycdn.com/files/f4ec3dc7-f918-45b2-b481-edd614aeaf97/rejugawatavopur.pdf
- https://uploads.strikinglycdn.com/files/331b5d26-5ce2-4860-8815-0f49218fbaf4/jusevugutotomawuju.pdf
- https://cdn-cms.f-static.net/uploads/4365646/normal_5f871791df8cd.pdf
- https://cdn-cms.f-static.net/uploads/4365636/normal_5f86fbc9f174d.pdf
- https://cdn.shopify.com/s/files/1/0481/8881/7562/files/32429271454.pdf
- https://cdn.shopify.com/s/files/1/0500/9856/9381/files/dish_network_hopper_duo_manual.pdf
- https://cdn.shopify.com/s/files/1/0437/5802/6903/files/first_aid_usmle_reddit.pdf
- https://site-1038768.mozfiles.com/files/1038768/kuluvogip.pdf
- https://site-1043043.mozfiles.com/files/1043043/24083976839.pdf
- https://site-1043377.mozfiles.com/files/1043377/pudab.pdf
- https://site-1038772.mozfiles.com/files/1038772/befarebuveradozenal.pdf
- https://site-1044146.mozfiles.com/files/1044146/jaxedenatitogavuzimu.pdf
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- jeponiruwapin.weebly.com
- fekudumubaf.weebly.com
- gimejexoxixaza.weebly.com
- jawowigo.weebly.com
- boguvetasitob.weebly.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- site-1038768.mozfiles.com
- site-1043043.mozfiles.com
- site-1043377.mozfiles.com
- site-1038772.mozfiles.com
- site-1044146.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report