MALICIOUS — fitok-xovozujaled-texel-jolekokovudamo.pdf
MALICIOUS — fitok-xovozujaled-texel-jolekokovudamo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
baaf33e2b868b4712323395e834440eb73dd2d6d55ae045fbcf0fbb49eb581f6 - SHA-1:
37e967d90d0f664b7afac183f767bdf4064aa699 - MD5:
455fc96be3d97244f09f5876e95cba34 - ssdeep:
768:REgGzpDHpUUCGjSA8GtCCBz8JD6Rt9lLtg59MEH7ihKsyne1xn4jQuN:/GFzp5CyzcC9l5KzH77sGGxuQuN - TLSH:
T13933AFF311A3ED8C7A8B9F0399EB206B614AD74C6037AB9055C8372DC4F85ED6E10961 - Submitted as: fitok-xovozujaled-texel-jolekokovudamo.pdf
- File type: pdf · Size: 52231 bytes
- Verdict: malicious (75/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://mupibidegupek.weebly.com/uploads/1/3/0/8/130874042/5711585.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=the%20lost%20city%20of%20z, https://uploads.strikinglycdn.com/files/f5a73e7c-b984-4a1c-b2af-0d1ff48d93d1/91536525019.pdf, https://uploads.strikinglycdn.com/files/373a029a-e41c-4c9a-a8c7-5dd42f5af639/49513570523.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=the%20lost%20city%20of%20z
- https://uploads.strikinglycdn.com/files/f5a73e7c-b984-4a1c-b2af-0d1ff48d93d1/91536525019.pdf
- https://uploads.strikinglycdn.com/files/373a029a-e41c-4c9a-a8c7-5dd42f5af639/49513570523.pdf
- https://uploads.strikinglycdn.com/files/46f86acd-1487-41ef-b125-517a16f541b9/xozikoboxevulonaze.pdf
- https://uploads.strikinglycdn.com/files/33f487c0-9d82-480c-9129-ebf40c52b246/roserixuvunejudi.pdf
- https://site-1041404.mozfiles.com/files/1041404/30848161744.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/b919b1ed8f.pdf
- https://kurikezexiwu.weebly.com/uploads/1/3/0/7/130775092/litisasevim.pdf
- https://xojisige.weebly.com/uploads/1/3/1/6/131637148/tubatilijomo-vepegugorezafib-lupaxori-melaminumu.pdf
- https://mupibidegupek.weebly.com/uploads/1/3/0/8/130874042/5711585.pdf
- https://uploads.strikinglycdn.com/files/8b982f43-7a71-45c8-80e6-9411341aeb69/todibabazek.pdf
- https://uploads.strikinglycdn.com/files/a44b0359-76a0-4fcf-9d6c-787f2dd3d90d/gevixubuvakapanadawavogo.pdf
- https://cdn-cms.f-static.net/uploads/4366335/normal_5f874acc16014.pdf
- https://cdn-cms.f-static.net/uploads/4365626/normal_5f875ff31917f.pdf
- https://cdn-cms.f-static.net/uploads/4367922/normal_5f875d1ba21ae.pdf
- https://cdn.shopify.com/s/files/1/0481/6145/6279/files/guitar_hero_3_legends_of_rock_custom_songs_pc.pdf
- https://cdn.shopify.com/s/files/1/0503/2080/1942/files/jeanette_winterson_written_on_the_body.pdf
- https://cdn.shopify.com/s/files/1/0432/2426/8968/files/mikiro.pdf
- https://cdn.shopify.com/s/files/1/0433/0638/5576/files/intermediate_microeconomics_8th_edition.pdf
- https://cdn.shopify.com/s/files/1/0485/0250/5633/files/wazozubikuxapapuxaguwu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- site-1041404.mozfiles.com
- zoxuzuxebexot.weebly.com
- kurikezexiwu.weebly.com
- xojisige.weebly.com
- mupibidegupek.weebly.com
- cdn-cms.f-static.net
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report