MALICIOUS — raxasevofagomiw.pdf

MALICIOUS — raxasevofagomiw.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 56c82dd0e3ecce4407a1867d28de4d1dbd9a6af9fc88eb3eb395ecf48f414841
• SHA-1: b56da9cb4ddbacd094f486895ab4a4cd7ad6ad1e
• MD5: 69451058836572d2b940eb70b0c654ca
• ssdeep: 1536:x/S0mn9I8C+55kfp5lEMsZBYMe8dqXncGvdxH3onOhF37:dS0mn9I8C+HkB5uxZFe80Xnc4vYGx
• TLSH: T1BD37E1F3511BEDCC67C64B97B891055A61CAD69C3523D7604188B67CCABCAAC3F20D50
• Submitted as: raxasevofagomiw.pdf
• File type: pdf · Size: 76181 bytes
• Verdict: malicious (94/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!694510588365

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/gapovowumepekegosiza.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://traffset.ru/wb?keyword=shell%20tapup%20cost, https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/gapovowumepekegosiza.pdf, https://uploads.strikinglycdn.com/files/e1a0ef85-f715-418e-bd3e-91c14664c868/25577255086.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffset.ru/wb?keyword=shell%20tapup%20cost
• https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/gapovowumepekegosiza.pdf
• https://s3.amazonaws.com/wetevali/8127778338.pdf
• https://uploads.strikinglycdn.com/files/e1a0ef85-f715-418e-bd3e-91c14664c868/25577255086.pdf
• https://s3.amazonaws.com/mivokozibu/partnership_agreement_template_in_bangladesh.pdf
• https://cdn-cms.f-static.net/uploads/4386330/normal_5fa05780d4b76.pdf
• https://wibiwiterudek.weebly.com/uploads/1/3/4/3/134373050/110823.pdf
• https://s3.amazonaws.com/subud/wogadizuv.pdf
• https://nepopuzabigeju.weebly.com/uploads/1/3/4/8/134856357/4b54e.pdf
• https://cdn.sqhk.co/sezelijimofi/IsBgfhc/40611014821.pdf
• https://nibuwoxemunovox.weebly.com/uploads/1/3/4/7/134714338/7364780.pdf
• https://s3.amazonaws.com/pasawexawinogad/46622950520.pdf
• https://cdn.sqhk.co/gasubapo/jgvBRv4/artillery_translation_in_spanish.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffset.ru
• genigudepa.weebly.com
• s3.amazonaws.com
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• wibiwiterudek.weebly.com
• nepopuzabigeju.weebly.com
• cdn.sqhk.co
• nibuwoxemunovox.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report