MALICIOUS — normal_5f88f1b9b81f9.pdf
MALICIOUS — normal_5f88f1b9b81f9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6a4f17ef4313992493c0d580c88f1201fb2f0f422cae7fb982c33df20a5805c0 - SHA-1:
0601b5f9fcaf70ed03f8c9cae9f1e88e3cc64db1 - MD5:
bfcabbb699a57198bb28332ff9a244a2 - ssdeep:
1536:hGFDp46YnQs+ayZWl6pqWssdxJCrUftD2jK/vh1W6TZqFC:EFDp1sQM6pldqQlD2jCh1x - TLSH:
T13E35AEF70087ED8C7B8A9F13AEEB109974C9C78D6132925045DD6A3CD97CABD6E00821 - Submitted as: normal_5f88f1b9b81f9.pdf
- File type: pdf · Size: 61952 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/9276785.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cctraff.ru/123?keyword=connective+tissue+diseases+pdf, https://zesopupejilit.weebly.com/uploads/1/3/0/7/130738861/fokisitodidugu-nijebesudavit.pdf, https://rivisoni.weebly.com/uploads/1/3/0/7/130739016/vigulusudeloku.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=connective+tissue+diseases+pdf
- https://zesopupejilit.weebly.com/uploads/1/3/0/7/130738861/fokisitodidugu-nijebesudavit.pdf
- https://rivisoni.weebly.com/uploads/1/3/0/7/130739016/vigulusudeloku.pdf
- https://zesopupejilit.weebly.com/uploads/1/3/0/7/130738861/8276185f.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/9276785.pdf
- https://zuxuzesis.weebly.com/uploads/1/3/1/4/131438019/a80a069777.pdf
- https://uploads.strikinglycdn.com/files/776ba7de-9039-4629-ad3a-2d17bce33449/tenanagubesu.pdf
- https://uploads.strikinglycdn.com/files/47536983-cd21-4788-aaad-33e283414793/65095999351.pdf
- https://site-1039346.mozfiles.com/files/1039346/fuvafatod.pdf
- https://site-1039391.mozfiles.com/files/1039391/mutakadegivomajodipar.pdf
- https://site-1039547.mozfiles.com/files/1039547/majedasowezu.pdf
- https://site-1039923.mozfiles.com/files/1039923/84996516749.pdf
- https://site-1039199.mozfiles.com/files/1039199/lamulonejowazadoxup.pdf
- https://site-1048288.mozfiles.com/files/1048288/viretinuxaridofabudosemab.pdf
- https://site-1039343.mozfiles.com/files/1039343/87816151822.pdf
- https://site-1041770.mozfiles.com/files/1041770/xarobigavubifitokizu.pdf
- https://winomumamo.weebly.com/uploads/1/3/1/0/131070375/mozobobabibov.pdf
- https://tabuxeniki.weebly.com/uploads/1/3/2/6/132682737/dofuwikajabuj.pdf
- https://tavumake.weebly.com/uploads/1/3/2/7/132740551/titefagat.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/1a27643b41869.pdf
- https://cdn-cms.f-static.net/uploads/4365657/normal_5f88b6cf9c055.pdf
- https://cdn-cms.f-static.net/uploads/4365539/normal_5f87199fb9723.pdf
- https://cdn-cms.f-static.net/uploads/4365621/normal_5f86fee14df2a.pdf
- https://cdn-cms.f-static.net/uploads/4367950/normal_5f8860d6ba491.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- zesopupejilit.weebly.com
- rivisoni.weebly.com
- dutitujazekap.weebly.com
- zuxuzesis.weebly.com
- uploads.strikinglycdn.com
- site-1039346.mozfiles.com
- site-1039391.mozfiles.com
- site-1039547.mozfiles.com
- site-1039923.mozfiles.com
- site-1039199.mozfiles.com
- site-1048288.mozfiles.com
- site-1039343.mozfiles.com
- site-1041770.mozfiles.com
- winomumamo.weebly.com
- tabuxeniki.weebly.com
- tavumake.weebly.com
- zoxuzuxebexot.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report