MALICIOUS — goxonel.pdf
MALICIOUS — goxonel.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
8e9eafce0611c6e3358c277e9805848bb156c795e7901408af6a7d33765d6476 - SHA-1:
c15071b375b350668f339a0b7da7abfb426cba3b - MD5:
6926afb5cc22a59200adc3b6b9122ee6 - ssdeep:
768:hgGzpDvVpsJMNy0iKWdYWOjs5ZIPTn/N0BZoy/8stzk+Ofaw82vTbLpaO:SGFRpsJaEf0sto+O7bLpb - TLSH:
T177318CF714ABED4C7A8A5B03ACA72556918DCB887232D790448C772CE57CABD7E10870 - Submitted as: goxonel.pdf
- File type: pdf · Size: 40049 bytes
- Verdict: malicious (75/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://sakuvida.weebly.com/uploads/1/3/0/7/130775714/b2ec1e12114.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=celebrate%20recovery%20leader, https://gusumadanu.weebly.com/uploads/1/3/2/6/132695601/sizupakifuv.pdf, https://folanejo.weebly.com/uploads/1/3/0/7/130776558/6baf0f95a.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=celebrate%20recovery%20leader
- https://gusumadanu.weebly.com/uploads/1/3/2/6/132695601/sizupakifuv.pdf
- https://folanejo.weebly.com/uploads/1/3/0/7/130776558/6baf0f95a.pdf
- https://sakuvida.weebly.com/uploads/1/3/0/7/130775714/b2ec1e12114.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/tidivobinimigip-banez-batipafon.pdf
- https://gukaguse.weebly.com/uploads/1/3/1/3/131398473/zadoniko.pdf
- https://uploads.strikinglycdn.com/files/cd6d4b53-e291-47d1-842a-6fbc09f77257/jobubavikekojufivebujik.pdf
- https://uploads.strikinglycdn.com/files/1a5ead27-fd50-4220-a742-a096bf4f3d6b/sufalin.pdf
- https://uploads.strikinglycdn.com/files/507e936d-548c-44c5-bc7c-ddb5c2d5d37b/97899984522.pdf
- https://uploads.strikinglycdn.com/files/661acf93-1b84-4fe1-b229-7f4093527e87/5528707323.pdf
- https://cdn.shopify.com/s/files/1/0431/9802/1793/files/fisiologia_del_tejido_muscular.pdf
- https://cdn.shopify.com/s/files/1/0431/5545/6164/files/clean_cut_touchless_paper_towel_dispenser_stainless_finish.pdf
- https://cdn.shopify.com/s/files/1/0500/4630/4416/files/pleasant_valley_iowa_homes_for_sale.pdf
- https://cdn.shopify.com/s/files/1/0484/8815/3250/files/igraph_manual.pdf
- https://cdn-cms.f-static.net/uploads/4367289/normal_5f87dd7e88563.pdf
- https://cdn-cms.f-static.net/uploads/4370090/normal_5f8870a7b1e33.pdf
- https://cdn-cms.f-static.net/uploads/4366309/normal_5f88442aeb3e9.pdf
- https://cdn-cms.f-static.net/uploads/4369784/normal_5f88bf55d7d7b.pdf
- https://cdn-cms.f-static.net/uploads/4366044/normal_5f8712df8fb87.pdf
- https://cdn.shopify.com/s/files/1/0268/9158/3679/files/wosoxibukopazababubemi.pdf
- https://cdn.shopify.com/s/files/1/0502/4441/9757/files/wavelebifigexudo.pdf
- https://cdn.shopify.com/s/files/1/0485/3855/0427/files/gop_vs_dnc_convention.pdf
- https://cdn.shopify.com/s/files/1/0429/5720/9753/files/51180105668.pdf
- https://cdn.shopify.com/s/files/1/0266/8511/2496/files/guided_reading_activity_16_1_answers.pdf
- https://cdn.shopify.com/s/files/1/0433/6615/4394/files/moon_elf_5e_wikidot.pdf
Embedded domains
- ggtraff.ru
- gusumadanu.weebly.com
- folanejo.weebly.com
- sakuvida.weebly.com
- zoxuzuxebexot.weebly.com
- gukaguse.weebly.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report