MALICIOUS — normal_5f8db5fcab504.pdf
MALICIOUS — normal_5f8db5fcab504.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ebc5a5bf9d20cc48045fbba38d85d3b3c2ce9ea49f45ca8de080d8de475c75ed - SHA-1:
70a08807d2efea84bf38b011e3ccf78729ad96bb - MD5:
153aa05ade854ac9442a22fe05a75b92 - ssdeep:
768:vgGzpD2p44FhD/TCmogi7JVJR/InZnHkaRD5OMZu7DNeCn8inQMG7mKVHiNrOSQb:YGFyp5Jm8x5OuuciQR7mK/nueiHBr/K - TLSH:
T19E347DF310A7ED4C7A879B4369EB39AEA09EE3489132E7641588672CC47C77D6F10610 - Submitted as: normal_5f8db5fcab504.pdf
- File type: pdf · Size: 53922 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/dolopitubolagu.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cctraff.ru/123?keyword=bt+sports+guide+uk, https://cdn-cms.f-static.net/uploads/4385859/normal_5f8da7c4460fe.pdf, https://cdn-cms.f-static.net/uploads/4365551/normal_5f8b2328b40ab.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=bt+sports+guide+uk
- https://cdn-cms.f-static.net/uploads/4385859/normal_5f8da7c4460fe.pdf
- https://cdn-cms.f-static.net/uploads/4365551/normal_5f8b2328b40ab.pdf
- https://cdn-cms.f-static.net/uploads/4371004/normal_5f8bdbecabac3.pdf
- https://cdn-cms.f-static.net/uploads/4367299/normal_5f87d5471ae04.pdf
- https://kekerisasil.weebly.com/uploads/1/3/0/7/130775365/2299267.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/dolopitubolagu.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/a8401ec7a9859.pdf
- https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/jujalow.pdf
- https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/3218331.pdf
- https://cdn-cms.f-static.net/uploads/4382779/normal_5f8d7f25dbb71.pdf
- https://cdn-cms.f-static.net/uploads/4374951/normal_5f8d4af4859e5.pdf
- https://cdn-cms.f-static.net/uploads/4368467/normal_5f8894f204012.pdf
- https://cdn-cms.f-static.net/uploads/4368955/normal_5f893716dda69.pdf
- https://cdn-cms.f-static.net/uploads/4369185/normal_5f8c9b8c0908c.pdf
- https://nizesuvijeva.weebly.com/uploads/1/3/1/6/131607023/996a3751.pdf
- https://givifajilodox.weebly.com/uploads/1/3/0/8/130874655/1e7e928ed4f.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/b919b1ed8f.pdf
- https://wavuvavezexa.weebly.com/uploads/1/3/0/7/130775629/4e0663a59.pdf
- https://nalabusapigo.weebly.com/uploads/1/3/2/7/132740218/pubibivufi_benumupoki_nobiwipuji.pdf
- https://uploads.strikinglycdn.com/files/3933e36a-e547-44e7-b3a2-d9197d13c99f/kevekanarelexiburolite.pdf
- https://uploads.strikinglycdn.com/files/367f04fd-52b1-4e79-8b3f-a4012c31439c/why_is_louis_joliet_important.pdf
- https://uploads.strikinglycdn.com/files/9bc7d37d-144f-4142-b33e-4bf8660455d4/wilavaxajagawavevirijes.pdf
- https://uploads.strikinglycdn.com/files/ec975f0b-0090-42d2-86e2-17332023b32d/bikawiresuxof.pdf
- https://uploads.strikinglycdn.com/files/00df567f-cf71-44c8-8c1b-cc998c5cdca2/kokizowosezux.pdf
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- kekerisasil.weebly.com
- dutitujazekap.weebly.com
- fijojonibiw.weebly.com
- wepugimi.weebly.com
- fodezamu.weebly.com
- nizesuvijeva.weebly.com
- givifajilodox.weebly.com
- zoxuzuxebexot.weebly.com
- wavuvavezexa.weebly.com
- nalabusapigo.weebly.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
File paths
- M:\:OzFz[
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report