SUSPICIOUS — tobekibufupex.pdf
SUSPICIOUS — tobekibufupex.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7e554e41d2e09b8d9d220d5a73c115a2d41f5d26a7ac8a79e3f52e3a6c8d0b62 - SHA-1:
996bca9b57e9a249645ac2e9f6a6306056f2b61e - MD5:
3f707c8f00347cd5b763ff451344785d - ssdeep:
768:5gGzpD6e0KE/P6XHaRjOr6dJ9cZzIOJmAF45iAwztl4JvsJt8mxFIs7wHy+E5mb:6GFuexBMuNmA+5qTAvQJFIs7wfE5mb - TLSH:
T1E1339EF3609BDD8C3ACBAF03EEE611A9508AC3486136E794448C372DC5BC67DAE15950 - Submitted as: tobekibufupex.pdf
- File type: pdf · Size: 50740 bytes
- Verdict: suspicious (58/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/dfc2dc10-61e3-4fc2-befb-49da57cf15ac/the_surge_weapon_proficiency.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=ifb%20washing%20machine%20price%20list%202018%20pdf, https://cdn-cms.f-static.net/uploads/4384822/normal_5f8f95bccd8b5.pdf, https://cdn-cms.f-static.net/uploads/4370092/normal_5f903c4b9b034.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=ifb%20washing%20machine%20price%20list%202018%20pdf
- https://cdn-cms.f-static.net/uploads/4384822/normal_5f8f95bccd8b5.pdf
- https://cdn-cms.f-static.net/uploads/4370092/normal_5f903c4b9b034.pdf
- https://cdn-cms.f-static.net/uploads/4375093/normal_5f8c440d9e6da.pdf
- https://cdn-cms.f-static.net/uploads/4369343/normal_5f8ba052ae2e4.pdf
- https://uploads.strikinglycdn.com/files/ce45126c-c1f2-460c-888a-097b564378c7/green_day_boulevard_of_broken_dreams_lyrics_download.pdf
- https://uploads.strikinglycdn.com/files/dfc2dc10-61e3-4fc2-befb-49da57cf15ac/the_surge_weapon_proficiency.pdf
- https://uploads.strikinglycdn.com/files/73098277-e291-4025-bf54-b9f19e7ea011/giwikerufov.pdf
- https://uploads.strikinglycdn.com/files/bedbe160-29af-455c-a2f8-83020e2a2470/zappa_the_hard_way.pdf
- https://uploads.strikinglycdn.com/files/fdfd174e-f964-4517-a4fb-97898109b31b/2383025213.pdf
- https://jikeberu.weebly.com/uploads/1/3/1/8/131857846/2c14cc6b.pdf
- https://mogijoduvide.weebly.com/uploads/1/3/0/8/130814471/4609989.pdf
- https://bizumoku.weebly.com/uploads/1/3/2/6/132681494/5189562.pdf
- https://bizetuxerupa.weebly.com/uploads/1/3/0/8/130873791/4530131.pdf
- https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/4875903.pdf
- https://naxedomabaxa.weebly.com/uploads/1/3/1/6/131606472/2324205.pdf
- https://cdn-cms.f-static.net/uploads/4380382/normal_5f8fb53e3c0ad.pdf
- https://cdn-cms.f-static.net/uploads/4381102/normal_5f8df6b3e7ae9.pdf
- https://cdn-cms.f-static.net/uploads/4366050/normal_5f8c1cb52120d.pdf
- https://cdn-cms.f-static.net/uploads/4367283/normal_5f879bb7746cc.pdf
- https://uploads.strikinglycdn.com/files/95e2d941-1d69-4f8c-8d5b-b7df330ea6d3/jilotepesizem.pdf
- https://uploads.strikinglycdn.com/files/f0fddfb5-b7cd-45f5-929d-558fd403462d/92845699852.pdf
- https://uploads.strikinglycdn.com/files/73411af3-fdc0-4f28-8025-a585ed431cff/3983436357.pdf
- https://uploads.strikinglycdn.com/files/31f3d054-0e2e-40eb-8a05-6f72dd122cf4/40695900507.pdf
- https://uploads.strikinglycdn.com/files/eefe30b4-72aa-4547-8501-bdb2e466ae5f/27583060922.pdf
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- jikeberu.weebly.com
- mogijoduvide.weebly.com
- bizumoku.weebly.com
- bizetuxerupa.weebly.com
- moxitasa.weebly.com
- naxedomabaxa.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report