MALICIOUS — ximudofotona_bewufomobutaxip_wadowupez.pdf
MALICIOUS — ximudofotona_bewufomobutaxip_wadowupez.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6c401eaa8d2b14fb03a0e609145cbaeadb1f7b6bf6a395b3b2c102d3df4a3232 - SHA-1:
6dfe077c15c6e394bd504cb6fee935f03711f4aa - MD5:
1ab53f1761710c4fad7febacb5d41afa - ssdeep:
768:lHgGzpDSp+oIaYR3Va+ktTWTvMlUqkL/t31pRZ9+8KoFUvNWWiFxaAvQb:lAGFupwk+qMJ5+BoSlWxxvQb - TLSH:
T170307CF750A7DE4C7A8BAB036DAB11195189D34DA132E790458C3B2CD4BC6BDBF10860 - Submitted as: ximudofotona_bewufomobutaxip_wadowupez.pdf
- File type: pdf · Size: 37872 bytes
- Verdict: malicious (75/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://cdn-cms.f-static.net/uploads/4366659/normal_5f875b72673cd.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=as%20you%20think%20james%20allen%20download%20pd, https://cdn-cms.f-static.net/uploads/4366659/normal_5f875b72673cd.pdf, https://cdn-cms.f-static.net/uploads/4366031/normal_5f87044a60d40.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=as%20you%20think%20james%20allen%20download%20pd
- https://cdn-cms.f-static.net/uploads/4366659/normal_5f875b72673cd.pdf
- https://cdn-cms.f-static.net/uploads/4366031/normal_5f87044a60d40.pdf
- https://cdn-cms.f-static.net/uploads/4365662/normal_5f876af615fa5.pdf
- https://cdn-cms.f-static.net/uploads/4367271/normal_5f87abf4014de.pdf
- https://cdn-cms.f-static.net/uploads/4365662/normal_5f8732db3bd21.pdf
- https://site-1048453.mozfiles.com/files/1048453/nakemagagerej.pdf
- https://site-1038602.mozfiles.com/files/1038602/kiwifupujizizawesub.pdf
- https://cdn.shopify.com/s/files/1/0483/8676/9053/files/nibomurisetediza.pdf
- https://cdn.shopify.com/s/files/1/0431/9209/0784/files/40105951821.pdf
- https://cdn.shopify.com/s/files/1/0488/4565/2133/files/lip_sync_guide_animation.pdf
- https://cdn.shopify.com/s/files/1/0465/2515/3430/files/chevy_impala_manual_transmission_for_sale.pdf
- https://cdn.shopify.com/s/files/1/0437/7696/6808/files/54653970916.pdf
- https://uploads.strikinglycdn.com/files/77537ca9-fa59-4f99-bb58-809209c2df3b/vapopiripixegalawomufid.pdf
- https://uploads.strikinglycdn.com/files/5d297c9d-f84c-47ec-8dfa-9359be2888e2/gufozesibub.pdf
- https://uploads.strikinglycdn.com/files/77d58091-afc7-4b5a-bc6e-ea92b212ea0b/90419703123.pdf
- https://uploads.strikinglycdn.com/files/bd179c5a-6099-4ef7-a342-49535c2c7950/japipad.pdf
- https://uploads.strikinglycdn.com/files/e0c14e87-fbea-4236-92e1-14bbb3bce376/90084636743.pdf
- https://site-1039634.mozfiles.com/files/1039634/memababutisoluguvojugogib.pdf
- https://site-1039892.mozfiles.com/files/1039892/10251710012.pdf
- https://site-1038744.mozfiles.com/files/1038744/7951536928.pdf
- https://site-1041289.mozfiles.com/files/1041289/ranonifoxazoxolirefevuna.pdf
- https://site-1039493.mozfiles.com/files/1039493/kilekogax.pdf
- https://site-1044303.mozfiles.com/files/1044303/21385767930.pdf
- https://site-1042969.mozfiles.com/files/1042969/31478319321.pdf
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- site-1048453.mozfiles.com
- site-1038602.mozfiles.com
- cdn.shopify.com
- uploads.strikinglycdn.com
- site-1039634.mozfiles.com
- site-1039892.mozfiles.com
- site-1038744.mozfiles.com
- site-1041289.mozfiles.com
- site-1039493.mozfiles.com
- site-1044303.mozfiles.com
- site-1042969.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report