MALICIOUS — uan_parmaklar_hz_testi.pdf
MALICIOUS — uan_parmaklar_hz_testi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (71/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
9de7b09cca80add08f431960e77dcaed2cbe09a5aa61d5a771b0e9b4b592d098 - SHA-1:
f2280c3a39d72ae1eddc45794672dba9fb68ea57 - MD5:
6cad00c719b37b22f7272f06feca7f8c - ssdeep:
768:lgGzpDGJpDo3FV28BxP1axxA1fehwk5q7rZpM+SSSo7qcRH:2GF6JpD0PG5qXZaKSo7qcRH - TLSH:
T1F7306CF310E7DD8C3E8B9B93ADA71695618AC78D7132A7901498762CC47C6FC2F10A61 - Submitted as: uan_parmaklar_hz_testi.pdf
- File type: pdf · Size: 38914 bytes
- Verdict: malicious (71/100)
Detections (2 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 71/100 is the fusion of 3 weighted signals:
- Embedded link rated malicious by URL analysis: https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/palaj_xofepevez.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=u%25C3%25A7an+parmaklar+h%25C4%25B1z+testi, https://cdn-cms.f-static.net/uploads/4377679/normal_5f8a4faba3a31.pdf, https://cdn-cms.f-static.net/uploads/4378165/normal_5f8af7cfe9ade.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/strik?keyword=u%25C3%25A7an+parmaklar+h%25C4%25B1z+testi
- https://cdn-cms.f-static.net/uploads/4377679/normal_5f8a4faba3a31.pdf
- https://cdn-cms.f-static.net/uploads/4378165/normal_5f8af7cfe9ade.pdf
- https://cdn-cms.f-static.net/uploads/4365555/normal_5f8b334994074.pdf
- https://cdn-cms.f-static.net/uploads/4367648/normal_5f8ac9e95646d.pdf
- https://cdn-cms.f-static.net/uploads/4365540/normal_5f87e5b9ed74a.pdf
- https://tevirilozarenov.weebly.com/uploads/1/3/2/6/132695732/penubudel.pdf
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/palaj_xofepevez.pdf
- https://dagigokes.weebly.com/uploads/1/3/0/7/130739756/1648062.pdf
- https://xoraxabaxid.weebly.com/uploads/1/3/2/6/132682630/lerepomuxe.pdf
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/mikukinib.pdf
- https://dubuzosokiboxof.weebly.com/uploads/1/3/1/1/131163723/fotojijomuwi_tukelap_zasadusit.pdf
- https://funiwulew.weebly.com/uploads/1/3/2/8/132814073/1872664.pdf
- https://wavuvavezexa.weebly.com/uploads/1/3/0/7/130775629/e9ffb505617aa6.pdf
- https://cdn-cms.f-static.net/uploads/4367290/normal_5f87ba62e8cf6.pdf
- https://cdn-cms.f-static.net/uploads/4366647/normal_5f8772a86b61c.pdf
- https://cdn-cms.f-static.net/uploads/4367648/normal_5f874c171bed1.pdf
- https://cdn-cms.f-static.net/uploads/4369185/normal_5f88a400b8547.pdf
- https://cdn-cms.f-static.net/uploads/4369514/normal_5f88f103f3678.pdf
- https://cdn-cms.f-static.net/uploads/4366057/normal_5f870bc2908ee.pdf
- https://cdn.shopify.com/s/files/1/0494/0477/2508/files/omegle_chat_video_apk.pdf
- https://cdn.shopify.com/s/files/1/0499/8843/6118/files/react_native_create_debug_apk.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- tevirilozarenov.weebly.com
- guwomenod.weebly.com
- dagigokes.weebly.com
- xoraxabaxid.weebly.com
- keniwuki.weebly.com
- dubuzosokiboxof.weebly.com
- funiwulew.weebly.com
- wavuvavezexa.weebly.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report