MALICIOUS — vamireraki.pdf
MALICIOUS — vamireraki.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
8beda5b135124de379340be21187ad8f26613d34a3c837f540ade0d482287d34 - SHA-1:
8fae028acb2d6635ab3f7917f5c7e7d391089792 - MD5:
ae29c0672c1d4749722030d2620d86a0 - ssdeep:
1536:bFemF4qAdZ1hJQ2WpkgYZ1XILd2iiPPbXgc3rBIti69pM620VX:phF47v1ha2WpkXXI0iY36t3boS - TLSH:
T1C138E0F31097DD4CEACE9F572A9A156CA199C2483232DBA09598736CC43C3EE7E10D46 - Submitted as: vamireraki.pdf
- File type: pdf · Size: 83645 bytes
- Verdict: malicious (94/100)
Detections (5 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!AE29C0672C1D
- Kaspersky (KVRT): HEUR:Hoax.PDF.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://static.s123-cdn-static.com/uploads/4443617/normal_5fccb4b58762f.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://trafftec.ru/wb?keyword=ninja%20air%20fryer%20xl%20reviews, https://cdn-cms.f-static.net/uploads/4373264/normal_5fd16a0f82cce.pdf, http://idealicaitalia-oficial.site/reading_comprehension_worksheets_for_high_school_studentswi8h6.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://trafftec.ru/wb?keyword=ninja%20air%20fryer%20xl%20reviews
- https://cdn-cms.f-static.net/uploads/4373264/normal_5fd16a0f82cce.pdf
- http://idealicaitalia-oficial.site/reading_comprehension_worksheets_for_high_school_studentswi8h6.pdf
- https://s3.amazonaws.com/kukupunopedon/49291909312.pdf
- http://kaporeko.rf.gd/64370613949.pdf
- http://talakukatutevib.epizy.com/75114798166.pdf
- https://dejoputaxili.weebly.com/uploads/1/3/4/7/134763817/rilederad_nodarasibip_babur.pdf
- https://lixubirenolona.weebly.com/uploads/1/3/4/6/134669397/9124131.pdf
- http://zebinopo.epizy.com/culligan_he_water_softener_manual.pdf
- https://static.s123-cdn-static.com/uploads/4443617/normal_5fccb4b58762f.pdf
- http://reduslim-italia.website/52239244673ib4ws.pdf
- https://s3.amazonaws.com/tugabijenovili/dwg_to_cdr_converter_free.pdf
- http://vashe-zdorovie.xyz/galanz_mini_fridge_manual_temperaturejo30r.pdf
- https://titapogesasoja.weebly.com/uploads/1/3/1/3/131380181/xoxuwu-repafolozojo-rojuziwudu.pdf
- http://dkblogin-de.best/arcgis_10._5_eitim_kitabm80lq.pdf
- https://static.s123-cdn-static.com/uploads/4380858/normal_6004f7567d1c8.pdf
- http://waliwijufe.iblogger.org/mitotowopetofepawuvoka.pdf
- https://static.s123-cdn-static.com/uploads/4404123/normal_6001fc9764d59.pdf
- https://cdn-cms.f-static.net/uploads/4445532/normal_600d5d22e39f0.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- trafftec.ru
- cdn-cms.f-static.net
- idealicaitalia-oficial.site
- s3.amazonaws.com
- talakukatutevib.epizy.com
- dejoputaxili.weebly.com
- lixubirenolona.weebly.com
- zebinopo.epizy.com
- static.s123-cdn-static.com
- vashe-zdorovie.xyz
- titapogesasoja.weebly.com
- waliwijufe.iblogger.org
- www.w3.org
- purl.org
- ns.adobe.com
- kaporeko.rf.gd
- reduslim-italia.website
- dkblogin-de.best
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report