MALICIOUS — mebatawob.pdf
MALICIOUS — mebatawob.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (71/100). 1 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
b81a82199494ff144421c9deac5e7e8c4ba91c03a6e14c0f4640987c406072a2 - SHA-1:
eaba1384c0e0c6f329d35299d05ed41f24431a69 - MD5:
03093e9628b583ccd9dd3e40582d523e - ssdeep:
384:SsFlS3K6XgKV7cAgdOpW+0Re1yNT2PctctSauKXjwyQ60gNdWBZ+PCUSLJqoFKYn:SgGzpD0eqodWBZsGhFue9TnfaWybmo4 - TLSH:
T176304CF310E7ED8C7A8BAB43ADA71199608EC3487137D7904498766DC4BC6AD7F11860 - Submitted as: mebatawob.pdf
- File type: pdf · Size: 38459 bytes
- Verdict: malicious (71/100)
Detections (1 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 71/100 is the fusion of 3 weighted signals:
- Embedded link rated malicious by URL analysis: https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/f9007.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=dr%20hubert%20chamouni, https://uploads.strikinglycdn.com/files/bec3cd58-861a-43ad-9949-98dcdf1ec9dd/tiveparuzasubuvatat.pdf, https://uploads.strikinglycdn.com/files/7b42656c-a34e-44f5-b6aa-6667ecc56a7c/85551944859.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=dr%20hubert%20chamouni
- https://uploads.strikinglycdn.com/files/bec3cd58-861a-43ad-9949-98dcdf1ec9dd/tiveparuzasubuvatat.pdf
- https://uploads.strikinglycdn.com/files/7b42656c-a34e-44f5-b6aa-6667ecc56a7c/85551944859.pdf
- https://uploads.strikinglycdn.com/files/bf79d7b3-0841-4318-93cb-d01b90496903/sabodesiruvebalus.pdf
- https://uploads.strikinglycdn.com/files/030068fd-e9a4-468e-b170-5b556de977dd/44580499586.pdf
- https://uploads.strikinglycdn.com/files/ade91645-aef9-4356-b68b-141cb5c183a1/jokagonamogix.pdf
- https://uploads.strikinglycdn.com/files/fc29add1-a0d1-4e5c-9663-88d73747588b/boxesof.pdf
- https://zeteparikimifol.weebly.com/uploads/1/3/1/6/131637109/4ebde.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/f9007.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/ratefunerod.pdf
- https://melegejisud.weebly.com/uploads/1/3/1/3/131379421/zarugude.pdf
- https://site-1039633.mozfiles.com/files/1039633/tovovanefolaw.pdf
- https://site-1042199.mozfiles.com/files/1042199/legirutozupupejisewas.pdf
- https://site-1042347.mozfiles.com/files/1042347/77482567190.pdf
- https://site-1042867.mozfiles.com/files/1042867/nexivuna.pdf
- https://site-1044152.mozfiles.com/files/1044152/konigenixedag.pdf
- https://site-1037882.mozfiles.com/files/1037882/72468138015.pdf
- https://site-1039737.mozfiles.com/files/1039737/96497032130.pdf
- https://site-1038924.mozfiles.com/files/1038924/68320835170.pdf
- https://site-1043445.mozfiles.com/files/1043445/kiwiranaxu.pdf
- https://site-1037176.mozfiles.com/files/1037176/57933155169.pdf
- https://site-1038303.mozfiles.com/files/1038303/88069094028.pdf
- https://site-1044076.mozfiles.com/files/1044076/witadowizomulisuno.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- ggtraff.ru
- uploads.strikinglycdn.com
- zeteparikimifol.weebly.com
- dutitujazekap.weebly.com
- melegejisud.weebly.com
- site-1039633.mozfiles.com
- site-1042199.mozfiles.com
- site-1042347.mozfiles.com
- site-1042867.mozfiles.com
- site-1044152.mozfiles.com
- site-1037882.mozfiles.com
- site-1039737.mozfiles.com
- site-1038924.mozfiles.com
- site-1043445.mozfiles.com
- site-1037176.mozfiles.com
- site-1038303.mozfiles.com
- site-1044076.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report