MALICIOUS — bokemotej.pdf
MALICIOUS — bokemotej.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
a40967561d0a65b9bb05ecededa19ec7e93b2f2866cc67acdbcda9b9ed92cab0 - SHA-1:
8b3356efc7c0da5f34e3440ef20a146ee02145e7 - MD5:
1e4c21bfda556c7c887a20be486a6a04 - ssdeep:
1536:AuRetIJB2kyvtIEoociVzpV0iuk9DQqdToINthhPa6Dr:Au4tVtq8VzgiuAMqpoIbOk - TLSH:
T1C436DFF3225BDF8892A777433DF510496489E389383166A048C4BBBDC2B43ED6F59921 - Submitted as: bokemotej.pdf
- File type: pdf · Size: 67992 bytes
- Verdict: malicious (94/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/c9050942-69f1-4925-98dc-bfdf64b9ebae/dusutepejalikuxadumigi.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://traffset.ru/wb?keyword=covalent%20bonding%20worksheet%20boardworks%20answers, https://uploads.strikinglycdn.com/files/c9050942-69f1-4925-98dc-bfdf64b9ebae/dusutepejalikuxadumigi.pdf, https://uploads.strikinglycdn.com/files/b46b23e3-215e-48b7-968c-7937445dee27/vurijin.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://traffset.ru/wb?keyword=covalent%20bonding%20worksheet%20boardworks%20answers
- https://uploads.strikinglycdn.com/files/c9050942-69f1-4925-98dc-bfdf64b9ebae/dusutepejalikuxadumigi.pdf
- https://uploads.strikinglycdn.com/files/b46b23e3-215e-48b7-968c-7937445dee27/vurijin.pdf
- https://ziroluberunoreg.weebly.com/uploads/1/3/4/4/134456507/gukobinuduzeb.pdf
- https://s3.amazonaws.com/fosagoba/south_african_theatre_history.pdf
- https://cdn-cms.f-static.net/uploads/4381544/normal_5f9a2cfd85174.pdf
- https://s3.amazonaws.com/tamobalasu/2317650642.pdf
- https://uploads.strikinglycdn.com/files/dae105f4-346c-4c8c-a75a-bd5541282a20/free_download_manorama_yearbook_2012.pdf
- https://s3.amazonaws.com/felasorarabipis/lekaledutuzugemomip.pdf
- https://uploads.strikinglycdn.com/files/2770e165-29c8-4a7a-8834-6a748fae2976/pac_man_championship_edition_dx_pc_d.pdf
- https://s3.amazonaws.com/kofabube/slow_motion_video_fx_pro_apk_download.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- traffset.ru
- uploads.strikinglycdn.com
- ziroluberunoreg.weebly.com
- s3.amazonaws.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report