MALICIOUS — tewitafawatifagamen.pdf
MALICIOUS — tewitafawatifagamen.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
8ade16a2c3783802173b30070c978f4a46611e8c1e076aab03d13dc58c287a7d - SHA-1:
49ff4f4d2472cb8730ea65a6e50cd4218c06b3f7 - MD5:
355fa4f4eca51694be2b9f0dec9a40ea - ssdeep:
1536:lKLOsr3ma+tio3ZM664a6hzajAiFSVaKideW5vGSWDCdAK7ebuvlW8pO+Lt2:ALPFybVakajA9aKidTCDCr7dv0+Q - TLSH:
T13638BFF32197DE4CB787DF43A9DB01A9608E83882161EB504188B76CD5BC9FDBE04991 - Submitted as: tewitafawatifagamen.pdf
- File type: pdf · Size: 77906 bytes
- Verdict: malicious (94/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: http://xn--9w3b11kh5l.com/ckupload/files/32846323932.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://drafthe.ru/uplcv?utm_term=launcher+iphone+12+apk, http://brlairport.com/images/file/nizopedebuzexozolo.pdf, http://www.amedna.com/userfiles/files/bulusaganotulapoli.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://drafthe.ru/uplcv?utm_term=launcher+iphone+12+apk
- http://brlairport.com/images/file/nizopedebuzexozolo.pdf
- http://www.amedna.com/userfiles/files/bulusaganotulapoli.pdf
- http://xn--9w3b11kh5l.com/ckupload/files/32846323932.pdf
- http://wuxihemei.com/ckfinder/userfiles/files/20210910_073215.pdf
- http://snbedu.com/uploadfile/file///2021090220504152.pdf
- http://mobiliteit.nu/files/narezewazudufadudolijebap.pdf
- http://sparkpro.lv/content/file/jitux.pdf
- https://www.padanguparduotuve.lt/ckfinder/userfiles/files/daberetawakotava.pdf
- https://mystruggle.uk/indigo/ckfinder/userfiles/files/pisefapirunesub.pdf
- http://ortosprendimai.lt/userfiles/file/sirog.pdf
- http://cnhhgj.com/upfiles/userfiles/file/wutunavitilikoveruxuli.pdf
- http://www.viksexteriors.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612fac8516d5d---relizaput.pdf
- https://chuyennhakienvangvn.net/upload/files/gorikazujerazisuge.pdf
- https://stpetejazz.com/wp-content/plugins/super-forms/uploads/php/files/8v352blko49dto4duss9fopggm/gabodeliwox.pdf
- http://zsmnowakowski.pl/userfiles/file/28111878017.pdf
- http://enjoybowlramenandpoke.com/uploads/files/61110592933.pdf
- https://mavismanagement.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613971d9f4137---dukutogaweruvarevazatisib.pdf
- http://mgtofubbq.com/uploads/files/33028901015.pdf
- http://saludocupacionalpso.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/1613024642cd8b---wokibafigafipif.pdf
- http://e-kva.ru/admin/ckfinder/userfiles/files/fakugaxoso.pdf
- https://irish-setter-zucht.info/ckfinder/userfiles/files/35530211664.pdf
- http://themetamorphoseprogram.com/userfiles/file/wozeropezimi.pdf
- https://instalacje-elektryczne.net/ckfinder/userfiles/files/76800908529.pdf
- https://www.toptalentusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614f1ceb72856---gemisapegarutovigeg.pdf
Embedded domains
- drafthe.ru
- brlairport.com
- www.amedna.com
- xn--9w3b11kh5l.com
- wuxihemei.com
- snbedu.com
- mystruggle.uk
- cnhhgj.com
- www.viksexteriors.com
- chuyennhakienvangvn.net
- stpetejazz.com
- zsmnowakowski.pl
- enjoybowlramenandpoke.com
- mavismanagement.com
- mgtofubbq.com
- saludocupacionalpso.com
- e-kva.ru
- irish-setter-zucht.info
- themetamorphoseprogram.com
- instalacje-elektryczne.net
- www.toptalentusa.com
- gcr.goldcrownresort.com
- brmhn.com
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report