MALICIOUS — joforiwubu_nevola_pivatesal_pitiz.pdf

MALICIOUS — joforiwubu_nevola_pivatesal_pitiz.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 839909cdcb758bbed4406aa74c0cbf0dde97afcc4b1f7536176fa044341675cc
• SHA-1: 85c9657110547d532c3f2165b694563c7db55f21
• MD5: bd251ec38cd14be1c43c45f4306b0337
• ssdeep: 3072:cw/MgFZMurJ9a4CHPKsV9ocJM9PGzFD35x9f5:c+vrCZvKsVSlcFlV
• TLSH: T1D53CF1F3A0ABDD4CBB8AD7037EA51029A94FD7582051EB4060547A7CC8B877C7D22E52
• Submitted as: joforiwubu_nevola_pivatesal_pitiz.pdf
• File type: pdf · Size: 113843 bytes
• Verdict: malicious (96/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4476590/normal_5fc4b0460d972.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: https://traffset.ru/wb?keyword=shape%20slicer%203d%20turn%20limit, https://cdn.sqhk.co/kurapobal/1ghwxPh/kevobawolatilorofowiza.pdf, https://cdn.sqhk.co/fisejadiruw/djc4bzH/94253532400.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffset.ru/wb?keyword=shape%20slicer%203d%20turn%20limit
• https://cdn.sqhk.co/kurapobal/1ghwxPh/kevobawolatilorofowiza.pdf
• https://cdn.sqhk.co/fisejadiruw/djc4bzH/94253532400.pdf
• https://risegexof.weebly.com/uploads/1/3/4/6/134661868/nakosuxizafeta.pdf
• https://cdn.sqhk.co/lixejudazeza/if3oibY/48374217807.pdf
• https://ginuwedisifixel.weebly.com/uploads/1/3/4/7/134744372/liluzukape_padakagupuz_konozusanulidom.pdf
• https://wapunukipebew.weebly.com/uploads/1/3/4/4/134440940/laxifizapo.pdf
• https://cdn.sqhk.co/xamapetarel/Ywjjrif/11555749170.pdf
• https://static.s123-cdn-static.com/uploads/4476590/normal_5fc4b0460d972.pdf
• https://fikosaxan.weebly.com/uploads/1/3/4/7/134753192/lufixodej_fuvoridonok.pdf
• https://cdn.sqhk.co/veleviziwew/UyDA5kE/4570874872.pdf
• https://cdn.sqhk.co/tewisifupib/wgfHhih/jawofufogufegez.pdf
• https://cdn.sqhk.co/wafixagi/iiehiM1/free_bubbles_vector.pdf
• https://kaledawuvilef.weebly.com/uploads/1/3/4/7/134727412/rapexut.pdf
• https://cdn.sqhk.co/vakanaju/fQhhdia/72068223630.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffset.ru
• cdn.sqhk.co
• risegexof.weebly.com
• ginuwedisifixel.weebly.com
• wapunukipebew.weebly.com
• static.s123-cdn-static.com
• fikosaxan.weebly.com
• kaledawuvilef.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report