MALICIOUS — wejoki.pdf

MALICIOUS — wejoki.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 9a7bb98548920f43bcf67b14e4c8488a681752872728295533caf5ba30618d96
• SHA-1: daaf4e7decacbb08d1e679a8f45e4eefd9331db5
• MD5: d2a1ca62f401e55f253a38e45cd96c81
• ssdeep: 1536:+K61AZlXXKfgR9HpTjrHdFUCP8eyfMNCsnHeMP1yX:U1AZlnKAnTr9NCsHJPE
• TLSH: T1B537D1F3A186CC0CEB8E7B576ED7192C2541E6886532EA6494C4377CC4787FE6E20902
• Submitted as: wejoki.pdf
• File type: pdf · Size: 76207 bytes
• Verdict: malicious (94/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!D2A1CA62F401
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://wegekasi.weebly.com/uploads/1/3/4/6/134678838/e8a5c2c929.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://maypoin.ru/wb?keyword=decd%20performance%20development%20plan%20template%202019, http://latilofu.rf.gd/lyric_video_template_shareae.pdf, http://rollernefritmassage.xyz/97137591757l62pz.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://maypoin.ru/wb?keyword=decd%20performance%20development%20plan%20template%202019
• https://s3.amazonaws.com/dogazisuze/9220365167.pdf
• http://latilofu.rf.gd/lyric_video_template_shareae.pdf
• http://rollernefritmassage.xyz/97137591757l62pz.pdf
• http://detonic-ordina.website/billie_eilish_my_future_lyrics_youtube30kqr.pdf
• https://wegekasi.weebly.com/uploads/1/3/4/6/134678838/e8a5c2c929.pdf
• http://haifaiv.ru/the_metamorphosis_and_other_storiesanr84.pdf
• http://parralax.net/carvedilol_davist4drc.pdf
• http://puwojewemuxa.epizy.com/watavekotewav.pdf
• http://robexekipojop.rf.gd/detanevimavugusaxa.pdf
• http://xatudoxi.epizy.com/bahubali_1_full_movie_hd_1080p.pdf
• http://topcreditreport.info/best_android_emulator_for_windows_108o5pq.pdf
• https://s3.amazonaws.com/gezetega/vibipoxinu.pdf
• http://damodudajipofem.22web.org/calendar_2019_app_free.pdf
• https://s3.amazonaws.com/megujobemegor/naxunibopimigexep.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• maypoin.ru
• s3.amazonaws.com
• rollernefritmassage.xyz
• wegekasi.weebly.com
• haifaiv.ru
• parralax.net
• puwojewemuxa.epizy.com
• xatudoxi.epizy.com
• topcreditreport.info
• damodudajipofem.22web.org
• www.w3.org
• purl.org
• ns.adobe.com
• latilofu.rf.gd
• detonic-ordina.website
• robexekipojop.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report