MALICIOUS — 7eec25f9afd7c3b.pdf
MALICIOUS — 7eec25f9afd7c3b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
eb4712754887fb30e70ac670267ac53062a9513e8ecedafdc4b6e9fc37dea00f - SHA-1:
905d676d1b2a1a85f23422f591c4c477ad86243c - MD5:
4f6e489d8f0a838140a391a4e23a39d3 - ssdeep:
768:RgGzpDP5pZ03oHIKJgMKG/2bhhqOjZJ+s1CgInnjZ6lxPcgLpNV1oyyWg1uoyO+b:iGF9pZeo5YZJP4DjCJcgLpuyyWg1uohA - TLSH:
T161327CF350A7EC8C398B9F43ADA71599A489D6486172D79048CC7B2CC4BC7BD6F00961 - Submitted as: 7eec25f9afd7c3b.pdf
- File type: pdf · Size: 47277 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/7971455.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=s%C3%B6z%20sanatlar%C4%B1%209.s%C4%B1n%C4%B1f, https://xetutinafo.weebly.com/uploads/1/3/0/7/130775845/pekesadumukubiberu.pdf, https://fanawilixu.weebly.com/uploads/1/3/1/4/131408209/8dd5a98a619.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=s%C3%B6z%20sanatlar%C4%B1%209.s%C4%B1n%C4%B1f
- https://xetutinafo.weebly.com/uploads/1/3/0/7/130775845/pekesadumukubiberu.pdf
- https://fanawilixu.weebly.com/uploads/1/3/1/4/131408209/8dd5a98a619.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/7971455.pdf
- https://bizetuxerupa.weebly.com/uploads/1/3/0/8/130873791/nagogivewufila.pdf
- https://uploads.strikinglycdn.com/files/b9c6c496-0369-4152-9f6d-503dc84eded1/sazenovorin.pdf
- https://uploads.strikinglycdn.com/files/a4f990f1-db90-47b8-8517-32aa91ecc822/26837491429.pdf
- https://cdn.shopify.com/s/files/1/0268/8054/0858/files/44421544104.pdf
- https://cdn.shopify.com/s/files/1/0435/7790/1214/files/horton_hears_a_who_book_online.pdf
- https://cdn.shopify.com/s/files/1/0427/5725/9420/files/lego_star_wars_cheat_codes_clone_wars.pdf
- https://cdn.shopify.com/s/files/1/0502/1673/0799/files/borabutimotumibasimo.pdf
- https://cdn-cms.f-static.net/uploads/4368471/normal_5f8b984deaaa4.pdf
- https://cdn-cms.f-static.net/uploads/4366020/normal_5f8758114b405.pdf
- https://cdn-cms.f-static.net/uploads/4366047/normal_5f86fbe813bd5.pdf
- https://cdn-cms.f-static.net/uploads/4375353/normal_5f89bf47e028e.pdf
- https://cdn-cms.f-static.net/uploads/4366362/normal_5f89259b70cad.pdf
- https://cdn-cms.f-static.net/uploads/4366947/normal_5f88f0b8749b6.pdf
- https://cdn-cms.f-static.net/uploads/4366993/normal_5f87e8bd0de00.pdf
- https://cdn-cms.f-static.net/uploads/4373517/normal_5f89e0702c2f2.pdf
- https://uploads.strikinglycdn.com/files/006b24f3-a378-4a31-b8f7-b58e560c3660/gakebisisabujowax.pdf
- https://uploads.strikinglycdn.com/files/c6bfabe2-e373-458c-9322-87b1f1d4925a/24663486302.pdf
- https://uploads.strikinglycdn.com/files/8e61c79f-3a5b-4d0a-b59e-f40a942f9a31/tozovotabibemepidajizovo.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ggtraff.ru
- xetutinafo.weebly.com
- fanawilixu.weebly.com
- dutitujazekap.weebly.com
- bizetuxerupa.weebly.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report