MALICIOUS — takukekawowiz.pdf

MALICIOUS — takukekawowiz.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: c0f3674ac1f98e887ffd8fca1b0caa8b2520abdc2913184e4968c0436dc1fb12
SHA-1: 0c5bab737d13ca98a0822249eb873bd91073b6e4
MD5: 5f93af80fbfa66f2d08dfe072a0750c9
ssdeep: 1536:sOMq/Kqmwio2M8MQPUgCYAWzOOJfuaJhe4VwFZWnNGvtfJ+Kv6:vM/ogPc37enJW8e+GtB+X
TLSH: T11D37D0F3539BDD8DA7594B977AF601086484D39860729A2414C8BB3C88BC6FF7E14E90
Submitted as: takukekawowiz.pdf
File type: pdf · Size: 71299 bytes
Verdict: malicious (96/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/b4b3eb38b.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://traffking.ru/wb?keyword=24petwatch%20claim%20form%202017, https://static1.squarespace.com/static/5fc29f5c5bcb0228a28d70dc/t/5fc38667145a8629dc1df142/1606649447586/61657374797.pdf, https://uploads.strikinglycdn.com/files/27e3b018-9fa7-43f6-9355-24903e5eb19a/dazojumukuzogasirobudija.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://traffking.ru/wb?keyword=24petwatch%20claim%20form%202017
https://static1.squarespace.com/static/5fc29f5c5bcb0228a28d70dc/t/5fc38667145a8629dc1df142/1606649447586/61657374797.pdf
https://uploads.strikinglycdn.com/files/27e3b018-9fa7-43f6-9355-24903e5eb19a/dazojumukuzogasirobudija.pdf
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd146c1d5d775a78523f31/1606227053246/7th_grade_spelling_words_games.pdf
https://s3.amazonaws.com/kovilowab/62122061560.pdf
https://static1.squarespace.com/static/5fc145c30a2757459be55efb/t/5fc4ef884f9837572079dd3b/1606741897406/rubyfruit_jungle.pdf
https://uploads.strikinglycdn.com/files/6ee1b4d4-4dff-474a-85a8-3cd7bee54ac9/11138250077.pdf
https://mufobaxepomek.weebly.com/uploads/1/3/4/8/134866816/b2a201139f.pdf
https://s3.amazonaws.com/lekezaru/redowifavojuf.pdf
https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/b4b3eb38b.pdf
https://uploads.strikinglycdn.com/files/2bdedb0a-bdce-41cb-b155-5862805856d0/20035141361.pdf
https://uploads.strikinglycdn.com/files/796bbc4b-9ad3-42b2-b93a-46c873715189/66774471911.pdf
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcee992edfcd2bda902a06/1606217369807/bedesapukejaxewojiz.pdf
https://uploads.strikinglycdn.com/files/030d9f66-7e44-4784-9e5c-fa3f902b8130/molabonuve.pdf
https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd10751491241adc48457a/1606226041232/jagojidimokizo.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

traffking.ru
static1.squarespace.com
uploads.strikinglycdn.com
s3.amazonaws.com
mufobaxepomek.weebly.com
gimejexoxixaza.weebly.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report