MALICIOUS — normal_5f8890679ce76.pdf

MALICIOUS — normal_5f8890679ce76.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 6e29b84a15d569f6d8ae2900d3ba9d58b1cef36e152c38e1a07deec2e5a94256
SHA-1: d187c1f094645e697f7999e492f04a2ffe71aad1
MD5: 785e0ecc36b1d8283684f0bea9b754fa
ssdeep: 768:6gGzpDppV7vkhnLbCNbHQUiIsMOrpcS75ASLJkGQTB4w:nGFFptdQlYOCSRLLQTB4w
TLSH: T158319EF31097ED4C7A8F6F036EAB10A9558AC68D6032E7A01488377DD57CAFD6E40960
Submitted as: normal_5f8890679ce76.pdf
File type: pdf · Size: 42046 bytes
Verdict: malicious (75/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Microsoft Defender: flagged
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 75/100 is the fusion of 4 weighted signals:

Embedded link rated malicious by URL analysis: https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/tixobenudofezibet.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://cctraff.ru/123?keyword=watch+power+season+5+episode+guide, https://lanasasaf.weebly.com/uploads/1/3/0/8/130815311/wosokomonokoniko.pdf, https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/tixobenudofezibet.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://cctraff.ru/123?keyword=watch+power+season+5+episode+guide
https://lanasasaf.weebly.com/uploads/1/3/0/8/130815311/wosokomonokoniko.pdf
https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/tixobenudofezibet.pdf
https://gevafitasib.weebly.com/uploads/1/3/1/3/131380901/a7b88.pdf
https://cdn-cms.f-static.net/uploads/4369315/normal_5f87c9c2565a7.pdf
https://uploads.strikinglycdn.com/files/8d26a38f-8fd9-4be7-8a6b-fcd8e6691486/45543495994.pdf
https://uploads.strikinglycdn.com/files/f444cae9-d2a6-4d3e-b3e8-b22403e18684/16940457987.pdf
https://uploads.strikinglycdn.com/files/449dc9d1-1f6c-4183-a0fe-af2ac4b8b4f2/70424844760.pdf
https://uploads.strikinglycdn.com/files/2007dc9d-6c5a-4ff5-913f-8762b9f7788d/zewuse.pdf
https://site-1038725.mozfiles.com/files/1038725/82911802853.pdf
https://site-1042013.mozfiles.com/files/1042013/zadedugusibaralaxugujiko.pdf
https://site-1037828.mozfiles.com/files/1037828/zonura.pdf
https://site-1039811.mozfiles.com/files/1039811/36049742329.pdf
https://site-1039878.mozfiles.com/files/1039878/delomajowozafuloxawixol.pdf
https://site-1040171.mozfiles.com/files/1040171/nebejavanuvudi.pdf
https://site-1039400.mozfiles.com/files/1039400/vekinovokekitirozadobeza.pdf
https://site-1040426.mozfiles.com/files/1040426/31482233425.pdf
https://cdn.shopify.com/s/files/1/0501/1318/3909/files/81805545803.pdf
https://cdn.shopify.com/s/files/1/0486/9275/6630/files/apexvs_answers_english_12_semester_1.pdf
https://cdn.shopify.com/s/files/1/0440/7413/9813/files/61549062889.pdf
https://cdn.shopify.com/s/files/1/0481/7403/9189/files/bolefu.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/

Embedded domains

cctraff.ru
lanasasaf.weebly.com
mogilifus.weebly.com
gevafitasib.weebly.com
cdn-cms.f-static.net
uploads.strikinglycdn.com
site-1038725.mozfiles.com
site-1042013.mozfiles.com
site-1037828.mozfiles.com
site-1039811.mozfiles.com
site-1039878.mozfiles.com
site-1040171.mozfiles.com
site-1039400.mozfiles.com
site-1040426.mozfiles.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report