MALICIOUS — 973998.pdf
MALICIOUS — 973998.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
d60c8fd6f0e16912620bf5de52d2352220e40d743dbb1ab21843e46269122169 - SHA-1:
7f08ce3fa588c00c4bfe431a1e41a78294bbcc52 - MD5:
acdbe1593c863197fa63c20047cceeac - ssdeep:
3072:BFRBy9dvtdnYWWuQI7FcoAeFLk3btCiJ6moaGYuUa3:njyztxj7ioD4hmaGDUI - TLSH:
T1703CE1F340A3DD4CB9CAAB13A5AA2469528ED74E60639B6044CCA13DD5FC6FD3F50920 - Submitted as: 973998.pdf
- File type: pdf · Size: 119334 bytes
- Verdict: malicious (75/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/059d55fbff3.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=marx%20feuerbach%20pdf, https://uploads.strikinglycdn.com/files/ea2118c7-601f-40cc-b55e-98627f486982/dotuf.pdf, https://uploads.strikinglycdn.com/files/c0de2684-4627-41e9-83ce-06f4db39adc7/gituke.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=marx%20feuerbach%20pdf
- https://uploads.strikinglycdn.com/files/ea2118c7-601f-40cc-b55e-98627f486982/dotuf.pdf
- https://uploads.strikinglycdn.com/files/c0de2684-4627-41e9-83ce-06f4db39adc7/gituke.pdf
- https://uploads.strikinglycdn.com/files/f0ea8389-2318-45ed-991c-c7df92d9cef1/royal_oaks_elementary_school_supply_list.pdf
- https://xumabilere.weebly.com/uploads/1/3/1/1/131163638/xexolov_texutob_parasorere_vadeg.pdf
- https://uploads.strikinglycdn.com/files/4e58d6c5-0d5c-44f7-af30-3d66ce34be81/birokipel.pdf
- https://jaxirifaru.weebly.com/uploads/1/3/4/5/134500995/rivimuna.pdf
- https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/059d55fbff3.pdf
- https://uploads.strikinglycdn.com/files/6a253a25-2c6f-4703-a905-39a1437df4f8/29212467588.pdf
- https://cdn-cms.f-static.net/uploads/4379220/normal_5f9415add8123.pdf
- https://uploads.strikinglycdn.com/files/c9dbc6a0-8b16-4ddd-a6b4-0d7382a717ec/kobapusexusad.pdf
- https://uploads.strikinglycdn.com/files/bd669695-4bf5-4150-90f8-869f658904ef/34935691822.pdf
- https://cdn-cms.f-static.net/uploads/4408721/normal_5f971cb21b796.pdf
- https://uploads.strikinglycdn.com/files/8234a667-9f21-4c89-9a6a-ba701f16e7af/53032398546.pdf
- https://uploads.strikinglycdn.com/files/d5c33cac-8745-4b79-880f-f2adaab6ca60/husqvarna_automatic_sewing_machine_manual.pdf
- https://uploads.strikinglycdn.com/files/3fc30d3d-953e-47a7-9c5f-ed16cce991d2/totukobomomubizibefomil.pdf
- https://uploads.strikinglycdn.com/files/56e06a31-eb1f-4884-a143-f84a3db6fa03/bubotikake.pdf
- https://uploads.strikinglycdn.com/files/4548bee4-1d1c-4428-bedd-2edfd71ff4b7/38643832860.pdf
- https://uploads.strikinglycdn.com/files/ef532ee3-9b16-43d3-b5ba-4b481c1488bc/66895902157.pdf
- https://uploads.strikinglycdn.com/files/a4a21a72-45ec-49d1-bf65-25c2d79899c3/24999782587.pdf
- https://uploads.strikinglycdn.com/files/e41b75d2-9232-4dea-951f-eec3e9a2b21e/85622347964.pdf
- https://ponixojezunuto.weebly.com/uploads/1/3/0/9/130969897/duzubikibulizekata.pdf
- https://uploads.strikinglycdn.com/files/2f4369af-9174-495f-aac5-d79079116304/tres_metros_sobre_el_cielo_cast.pdf
- https://cdn-cms.f-static.net/uploads/4366367/normal_5f87182dd68a9.pdf
- https://uploads.strikinglycdn.com/files/0e2ab332-9f85-45bb-ae8a-5783bd11fb84/21090034595.pdf
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- xumabilere.weebly.com
- jaxirifaru.weebly.com
- mogilifus.weebly.com
- cdn-cms.f-static.net
- ponixojezunuto.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report