MALICIOUS — normal_5f8723f6e7d0e.pdf
MALICIOUS — normal_5f8723f6e7d0e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
690bec8dd9bd2c98fb8778240cc02e32fde18a1980dcc127b3da06483269629e - SHA-1:
a533dc1fd042505b8230bcb6a8d4f8a509124b10 - MD5:
95bb47a6f562cefd7aa9624b5d564074 - ssdeep:
1536:/GFxpNx09GhohYpNXVtS7lrAXdmx8wtYW9Kp/pM6T:uFxpSYphVtS7l8XE3t9Opx - TLSH:
T13936BFF310A7DD4C7ACACF039AEA250D548ADA895133EB6094987B6CD47C7FC6E00961 - Submitted as: normal_5f8723f6e7d0e.pdf
- File type: pdf · Size: 67089 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://tajurasexir.weebly.com/uploads/1/3/1/6/131606020/2739071.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cctraff.ru/123?keyword=toefl+exam+example+pdf, https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/rezareludufiven-voxodopi.pdf, https://tajurasexir.weebly.com/uploads/1/3/1/6/131606020/2739071.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=toefl+exam+example+pdf
- https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/rezareludufiven-voxodopi.pdf
- https://tajurasexir.weebly.com/uploads/1/3/1/6/131606020/2739071.pdf
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/vovofofaverun_sawivurovoj_nifawubazox.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/nesubine.pdf
- https://cdn.shopify.com/s/files/1/0492/3464/1052/files/xamusi.pdf
- https://cdn.shopify.com/s/files/1/0495/7850/8440/files/zizefonevusabi.pdf
- https://cdn.shopify.com/s/files/1/0432/6601/5395/files/bukirunijo.pdf
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/1696278.pdf
- https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/sanufiruwula-nuxagadedanureg.pdf
- https://cdn.shopify.com/s/files/1/0499/8129/2706/files/lolijujedawadafopanipizu.pdf
- https://cdn.shopify.com/s/files/1/0481/0634/0515/files/layer_architecture_advantages.pdf
- https://cdn.shopify.com/s/files/1/0436/4474/7929/files/good_charlotte_dance_floor_anthem_live.pdf
- https://cdn.shopify.com/s/files/1/0430/1117/8649/files/gh_pember_livros.pdf
- https://cdn.shopify.com/s/files/1/0499/3826/8318/files/guide_to_physical_therapist_practice_2nd_edition_2003_citation.pdf
- https://cdn.shopify.com/s/files/1/0492/2844/7900/files/life_coaching_tools_and_techniques.pdf
- https://cdn.shopify.com/s/files/1/0434/7556/6752/files/tec_9_airsoft_uk.pdf
- https://cdn.shopify.com/s/files/1/0435/8661/7501/files/vejajamotojepapegin.pdf
- https://cdn.shopify.com/s/files/1/0493/6079/7862/files/cuales_fueron_las_primeras_civilizaciones_mesoamericanas.pdf
- https://site-1042783.mozfiles.com/files/1042783/61325416226.pdf
- https://site-1038943.mozfiles.com/files/1038943/46772891205.pdf
- https://site-1043177.mozfiles.com/files/1043177/zakamefurajuker.pdf
- https://site-1040785.mozfiles.com/files/1040785/tavonovupefobevetoluler.pdf
- https://site-1038720.mozfiles.com/files/1038720/57825053232.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- vuxozajuje.weebly.com
- tajurasexir.weebly.com
- genigudepa.weebly.com
- gimejexoxixaza.weebly.com
- cdn.shopify.com
- bedizegoresupa.weebly.com
- wepugimi.weebly.com
- site-1042783.mozfiles.com
- site-1038943.mozfiles.com
- site-1043177.mozfiles.com
- site-1040785.mozfiles.com
- site-1038720.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report