MALICIOUS — nopovujex.pdf
MALICIOUS — nopovujex.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
55e2b8e13c81cb92cba0aafc0516d078d668e2e2decbdf1e1d1c27a879949609 - SHA-1:
18ccba44e25cb2106ee2fe817df8f7acd90d0e23 - MD5:
57780aa613827dfaa3f69a9e45bcfb48 - ssdeep:
1536:IGFCp4U1tUKBTq305x7vWZYRR5+arHUDLzsBc4PoD:lFCp4eUYeK7+ZYR+eUDLI74 - TLSH:
T1E9348EF74097DE4CBA87CB036AAB255E604AD28D60369360048C676CCAFC7BDBF50561 - Submitted as: nopovujex.pdf
- File type: pdf · Size: 54767 bytes
- Verdict: malicious (75/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://jamuseramomuf.weebly.com/uploads/1/3/1/8/131871426/sugole.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=free%20download%20gba%20rom%20pokemon%20light, https://cdn.shopify.com/s/files/1/0435/4903/2607/files/making_a_toga_out_of_sheet.pdf, https://cdn.shopify.com/s/files/1/0439/2275/1643/files/putilukez.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=free%20download%20gba%20rom%20pokemon%20light
- https://cdn.shopify.com/s/files/1/0435/4903/2607/files/making_a_toga_out_of_sheet.pdf
- https://cdn.shopify.com/s/files/1/0439/2275/1643/files/putilukez.pdf
- https://cdn.shopify.com/s/files/1/0493/6509/0463/files/91380654538.pdf
- https://cdn.shopify.com/s/files/1/0481/2072/5667/files/natwest_online_banking_for_android.pdf
- https://cdn.shopify.com/s/files/1/0438/3866/8965/files/fuvudibonoviwufefumile.pdf
- https://jamuseramomuf.weebly.com/uploads/1/3/1/8/131871426/sugole.pdf
- https://walijogopabo.weebly.com/uploads/1/3/0/7/130776167/ravujebafir.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f89808de3bc1.pdf
- https://cdn-cms.f-static.net/uploads/4371495/normal_5f8a2e462b2e7.pdf
- https://cdn-cms.f-static.net/uploads/4365594/normal_5f88172b84d68.pdf
- https://cdn-cms.f-static.net/uploads/4366017/normal_5f870046bc5f2.pdf
- https://cdn-cms.f-static.net/uploads/4367296/normal_5f8aa3a317d18.pdf
- https://vunixumo.weebly.com/uploads/1/3/1/4/131453253/ad7f526e8d57e4.pdf
- https://rewemekekebaz.weebly.com/uploads/1/3/1/4/131406535/8f9093.pdf
- https://mabanopovofed.weebly.com/uploads/1/3/1/4/131453130/ce8a17394b.pdf
- https://walijogopabo.weebly.com/uploads/1/3/0/7/130776167/5300225.pdf
- https://rivisoni.weebly.com/uploads/1/3/0/7/130739016/7711683.pdf
- https://cdn.shopify.com/s/files/1/0502/6912/6853/files/8397460144.pdf
- https://cdn.shopify.com/s/files/1/0481/3514/3575/files/dihybrid_problems_worksheet_with_answers.pdf
- https://cdn.shopify.com/s/files/1/0435/0060/1504/files/bimimemebu.pdf
- https://cdn.shopify.com/s/files/1/0498/1977/9227/files/20000_btu_air_conditioner_with_heat.pdf
- https://cdn.shopify.com/s/files/1/0492/0649/3350/files/wuseb.pdf
- https://vedabigejiko.weebly.com/uploads/1/3/1/4/131438046/sewilefisinumo.pdf
- https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/gevoderovepiru.pdf
Embedded domains
- cctraff.ru
- cdn.shopify.com
- jamuseramomuf.weebly.com
- walijogopabo.weebly.com
- cdn-cms.f-static.net
- vunixumo.weebly.com
- rewemekekebaz.weebly.com
- mabanopovofed.weebly.com
- rivisoni.weebly.com
- vedabigejiko.weebly.com
- jawasolasazilem.weebly.com
- jakedekokobara.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report