MALICIOUS — tufupajowivi.pdf
MALICIOUS — tufupajowivi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
af52d33559de32e8f6e9e37c8f4912ca8045b3e1040bd73ae948a56cef98cf74 - SHA-1:
c3b6ff30667509ed0c26d12f6a917d7beca035bf - MD5:
1a39c896cdb58bc28ac484bd2119744a - ssdeep:
1536:YfeIssiEt424ZFRyuNWLhamO7UAemZESKykgF5WccsksDHWdlEzvCOmZes:9P8y3FjmjDmaSKyt5WEfDmlEDCOu - TLSH:
T11938D0F3B0A7CC4C6BC9971799B61568705ACB886571AF901088BA7CC4FC77D6F21A02 - Submitted as: tufupajowivi.pdf
- File type: pdf · Size: 77568 bytes
- Verdict: malicious (96/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated malicious by URL analysis: https://uploads.strikinglycdn.com/files/13901227-4b90-4d29-8b6c-de37e30af274/reunion_ess_avs.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://traffset.ru/wb?keyword=uma%20mahesh%20name%20ringtone, https://uploads.strikinglycdn.com/files/13901227-4b90-4d29-8b6c-de37e30af274/reunion_ess_avs.pdf, https://uploads.strikinglycdn.com/files/f9fda9d4-79cb-42ea-88ad-2369e5437281/49932561733.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://traffset.ru/wb?keyword=uma%20mahesh%20name%20ringtone
- https://uploads.strikinglycdn.com/files/13901227-4b90-4d29-8b6c-de37e30af274/reunion_ess_avs.pdf
- https://uploads.strikinglycdn.com/files/f9fda9d4-79cb-42ea-88ad-2369e5437281/49932561733.pdf
- https://uploads.strikinglycdn.com/files/bfc690e9-7ce5-455a-9aa1-42c0a7605788/38412453388.pdf
- https://uploads.strikinglycdn.com/files/89e54181-7e25-4235-8104-48d5aabc34c6/pamajajedo.pdf
- https://uploads.strikinglycdn.com/files/382cfac7-51bd-43e3-a993-04c5d886831a/57564846566.pdf
- https://cdn-cms.f-static.net/uploads/4387412/normal_5f9e3f8b3684e.pdf
- https://uploads.strikinglycdn.com/files/ddc54a72-31cf-4173-8936-bd567bf60209/fadadunek.pdf
- https://cdn-cms.f-static.net/uploads/4370265/normal_5fad46687ade1.pdf
- https://gusumadanu.weebly.com/uploads/1/3/2/6/132695601/womanawiwurek_dipewububexuti_tudanado.pdf
- https://uploads.strikinglycdn.com/files/fc28c9de-9481-4567-a738-e9004ab4cf1a/truck_rental_60201.pdf
- https://uploads.strikinglycdn.com/files/67dcf97f-70fc-44d7-b4db-050c73265806/libros_de_aritmetica_para_secundaria.pdf
- https://uploads.strikinglycdn.com/files/979ef6f3-1205-49e4-bddc-187ab6f282ed/engineering_vibration_solution_manual.pdf
- https://witorovi.weebly.com/uploads/1/3/4/6/134643219/5bda7c362.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- traffset.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- gusumadanu.weebly.com
- witorovi.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report