MALICIOUS — pujodil.pdf
MALICIOUS — pujodil.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
74371222070918764e2211c25db18ab7c36763b3f950d6305672c50e9e2c9c3a - SHA-1:
228f7052a9bbeae847a8fed7120a6de37ad14a65 - MD5:
c415e1a5489ec3f386429755addf7248 - ssdeep:
768:fgGzpDPeUuHZJX2su/w1m5CZTR1doKnDeeth5yuj59Zy4wxu/MLGT4lbbs:oGF7ehTR1GoeQAmDIxu/MLnlbbs - TLSH:
T148327DF314E7EE4C7ACA9B03ACB71495559ED78861329B604988772CC1BC2BDAF50C24 - Submitted as: pujodil.pdf
- File type: pdf · Size: 45754 bytes
- Verdict: malicious (75/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://rimesozarabef.weebly.com/uploads/1/3/1/6/131607712/d91c2928fdfa0.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=free%20first%20grade%20handwriting%20practice%20worksheets, https://cdn-cms.f-static.net/uploads/4368772/normal_5f88dbca278b8.pdf, https://cdn-cms.f-static.net/uploads/4365653/normal_5f86f72c4fa4d.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=free%20first%20grade%20handwriting%20practice%20worksheets
- https://cdn-cms.f-static.net/uploads/4368772/normal_5f88dbca278b8.pdf
- https://cdn-cms.f-static.net/uploads/4365653/normal_5f86f72c4fa4d.pdf
- https://cdn-cms.f-static.net/uploads/4366664/normal_5f874f1f0ce46.pdf
- https://cdn-cms.f-static.net/uploads/4365539/normal_5f874cbbc485d.pdf
- https://rimesozarabef.weebly.com/uploads/1/3/1/6/131607712/d91c2928fdfa0.pdf
- https://lodirunesu.weebly.com/uploads/1/3/0/8/130874391/vibisixogevopisi.pdf
- https://dojudiwoju.weebly.com/uploads/1/3/1/4/131406456/5426e4f5.pdf
- https://wuwuleli.weebly.com/uploads/1/3/1/3/131398564/babulebugiribukibip.pdf
- https://uploads.strikinglycdn.com/files/2d205024-c85a-4fa8-ac5a-196996773dad/kikerupulepevof.pdf
- https://uploads.strikinglycdn.com/files/fce99ed3-5f87-411e-8b0c-1e72ba428542/11311493118.pdf
- https://uploads.strikinglycdn.com/files/194b0657-2760-4c0c-b97b-2b0468e16ef0/wusono.pdf
- https://cdn.shopify.com/s/files/1/0431/2560/4513/files/vabirivikogaroxiguzol.pdf
- https://cdn.shopify.com/s/files/1/0467/7763/0873/files/garmin_735xt_user_guide.pdf
- https://cdn.shopify.com/s/files/1/0435/4405/1871/files/fuel_injector_tester_rental.pdf
- https://cdn.shopify.com/s/files/1/0432/7456/7843/files/laramie_wyoming_population_growth.pdf
- https://gonoloxezejuje.weebly.com/uploads/1/3/1/4/131410007/nowarewak.pdf
- https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/6276840.pdf
- https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/bizerokiva.pdf
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/belapigojat.pdf
- https://zevigetadafuwun.weebly.com/uploads/1/3/0/9/130969942/rosuwal.pdf
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/297c0.pdf
- https://mogezisatizate.weebly.com/uploads/1/3/0/7/130775403/e98d3333872.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- rimesozarabef.weebly.com
- lodirunesu.weebly.com
- dojudiwoju.weebly.com
- wuwuleli.weebly.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- gonoloxezejuje.weebly.com
- wepugimi.weebly.com
- guwomenod.weebly.com
- zevigetadafuwun.weebly.com
- mogezisatizate.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report