MALICIOUS — pafefik.pdf
MALICIOUS — pafefik.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
9b5dfc32ff95148509843255b325a38bba5b5d85f75063ff634cf3c85048fd72 - SHA-1:
6419ca23388c42a2d853e3cf6d212528769b6df4 - MD5:
bd8e287e18b8782ed714f18b893d550c - ssdeep:
1536:gGFGxxqRmE5hZ7GWNExJbNNTVuLLPSZZlJzAO:tFG/wR/7ZQTVkLablJh - TLSH:
T16F36AFF35097ED4D7B8AAB13B967116E618AC748603A93A001DD771CD4BC6BCFE20921 - Submitted as: pafefik.pdf
- File type: pdf · Size: 67232 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://nukevokisoget.weebly.com/uploads/1/3/2/7/132711970/zipijagaxegex-kasoxowexej.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=nccn%20guidelines%20kidney%20cancer%202019%20pdf, https://cdn.shopify.com/s/files/1/0268/7300/4230/files/filmorago_app_for_android_download.pdf, https://cdn.shopify.com/s/files/1/0456/4418/5767/files/dogeva.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=nccn%20guidelines%20kidney%20cancer%202019%20pdf
- https://cdn.shopify.com/s/files/1/0268/7300/4230/files/filmorago_app_for_android_download.pdf
- https://cdn.shopify.com/s/files/1/0456/4418/5767/files/dogeva.pdf
- https://cdn.shopify.com/s/files/1/0428/6224/8095/files/nuzeduvofifukitasax.pdf
- https://nukevokisoget.weebly.com/uploads/1/3/2/7/132711970/zipijagaxegex-kasoxowexej.pdf
- https://noxepelobisuse.weebly.com/uploads/1/3/1/8/131871648/8030446.pdf
- https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/c3271093f22bb4.pdf
- https://botubadixebom.weebly.com/uploads/1/3/1/4/131407995/7815099.pdf
- https://rukutatonaneto.weebly.com/uploads/1/3/4/0/134012616/modanijunore-pemuraleposore-xekowijibo.pdf
- https://gemenudotipetal.weebly.com/uploads/1/3/2/6/132695720/3c9b82e7661.pdf
- https://labajilawuja.weebly.com/uploads/1/3/1/4/131406369/lumominukene.pdf
- https://uploads.strikinglycdn.com/files/8b3474db-4fa5-4335-bcfe-740458b4ca38/gibemutopaguxepam.pdf
- https://uploads.strikinglycdn.com/files/5c20b10a-7de2-43d3-8060-275f6232d621/kejemeku.pdf
- https://uploads.strikinglycdn.com/files/5cbf38eb-8910-4d52-9d85-8295d451f5a0/biochemistry_book_campbell_free.pdf
- https://uploads.strikinglycdn.com/files/56b70dd8-4240-4deb-bedf-d0c1f6501724/91447252662.pdf
- https://uploads.strikinglycdn.com/files/ba895897-751c-4d23-996a-24af8f00c101/mofajukomonasemejusikox.pdf
- https://uploads.strikinglycdn.com/files/5b6c237c-3ab2-4fcb-81e9-c9186a843500/85500159087.pdf
- https://cdn.shopify.com/s/files/1/0503/8650/1806/files/conjunctions_worksheets_for_class_5.pdf
- https://cdn.shopify.com/s/files/1/0485/7040/0928/files/kijudotibopepuveliwox.pdf
- https://cdn.shopify.com/s/files/1/0497/2203/2285/files/dmc_5_bloody_palace_trophy_guide.pdf
- https://cdn.shopify.com/s/files/1/0266/9264/9132/files/tidomepemewagavaluxu.pdf
- https://cdn.shopify.com/s/files/1/0429/5540/7511/files/a_dolls_house_by_henrik_ibsen_download.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- cdn.shopify.com
- nukevokisoget.weebly.com
- noxepelobisuse.weebly.com
- moxitasa.weebly.com
- botubadixebom.weebly.com
- rukutatonaneto.weebly.com
- gemenudotipetal.weebly.com
- labajilawuja.weebly.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report