MALICIOUS — 1a8fa38f0be4f9b.pdf
MALICIOUS — 1a8fa38f0be4f9b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6404f4c7b75d0ac57f082366c399c55ff167f8c2dbd084da12d2d2d6afbd0462 - SHA-1:
05fce4037de6739ba3a283e5f1ff2cd9562e124f - MD5:
7c71e1f7cef9f0fc916b160c778415a6 - ssdeep:
768:egGzpDP/33hocM5lX4wRpPZxw0KmId0+anRPuVXqRj5UHTUIj:bGFbytlZCjGF1upqRt+TUIj - TLSH:
T1D3328DF310E7FC8C7ACA8B0399A61558A486D78D7136D3A04498B37DD8BC2BD9E54920 - Submitted as: 1a8fa38f0be4f9b.pdf
- File type: pdf · Size: 47022 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://kawewadibuporak.weebly.com/uploads/1/3/4/3/134371142/nuwewogi.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=schneider%20electrical%20installation%20guide%20iec-2013.pdf, https://cdn-cms.f-static.net/uploads/4402963/normal_5f93c3a9406bf.pdf, https://cdn-cms.f-static.net/uploads/4366029/normal_5f89a45f5d7cc.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=schneider%20electrical%20installation%20guide%20iec-2013.pdf
- https://cdn-cms.f-static.net/uploads/4402963/normal_5f93c3a9406bf.pdf
- https://cdn-cms.f-static.net/uploads/4366029/normal_5f89a45f5d7cc.pdf
- https://cdn-cms.f-static.net/uploads/4378618/normal_5f8fb442dc695.pdf
- https://cdn-cms.f-static.net/uploads/4379054/normal_5f8a8e3a1a9ab.pdf
- https://s3.amazonaws.com/kavitokolezub/best_self_planner.pdf
- https://s3.amazonaws.com/leguvefu/data_structures_and_algorithms_in_python_2016.pdf
- https://s3.amazonaws.com/felasorarabipis/26483260527.pdf
- https://uploads.strikinglycdn.com/files/06679dbb-86c7-462a-960c-d8ccdc338daf/dinerobegepubutasifusamub.pdf
- https://uploads.strikinglycdn.com/files/7088066f-b962-4b59-b62f-6b2af73e03bb/ribifufidezijikiwewi.pdf
- https://uploads.strikinglycdn.com/files/52382a54-354e-44b9-95d0-fd47219f76aa/jabutedogedofanezibe.pdf
- https://kawewadibuporak.weebly.com/uploads/1/3/4/3/134371142/nuwewogi.pdf
- https://wejibuxod.weebly.com/uploads/1/3/0/7/130740202/d5cfb8.pdf
- https://gurigibafex.weebly.com/uploads/1/3/0/7/130739571/rumalax-gixasufusez-labunajigom-popado.pdf
- https://rudofodirofebas.weebly.com/uploads/1/3/0/7/130739781/gifenamo_votogogowinipiz_vokuro_zavatijap.pdf
- https://s3.amazonaws.com/xuzed/68054884504.pdf
- https://s3.amazonaws.com/zunaduxa/tefidapu.pdf
- https://s3.amazonaws.com/vufupu/desktop_engineer_interview_questions.pdf
- https://s3.amazonaws.com/xanebavifamopez/25329876257.pdf
- https://s3.amazonaws.com/henghuili-files/82966952524.pdf
- https://bavejojonosepes.weebly.com/uploads/1/3/1/3/131380601/nazibipedan.pdf
- https://pepisukuwen.weebly.com/uploads/1/3/1/6/131606293/5824888.pdf
- https://lefedatit.weebly.com/uploads/1/3/0/7/130776734/wikezunafaba-pozipopifu.pdf
- https://kufazijofiw.weebly.com/uploads/1/3/0/7/130776126/6031201.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- s3.amazonaws.com
- uploads.strikinglycdn.com
- kawewadibuporak.weebly.com
- wejibuxod.weebly.com
- gurigibafex.weebly.com
- rudofodirofebas.weebly.com
- bavejojonosepes.weebly.com
- pepisukuwen.weebly.com
- lefedatit.weebly.com
- kufazijofiw.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report