MALICIOUS — normal_5f95b9e1c8160.pdf
MALICIOUS — normal_5f95b9e1c8160.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ec6e693a0023caaeefc13fde37a1f1fabccf6a1df12613374d51aef0796beff5 - SHA-1:
f45f5b4ff2e38fd0b6ea4c830cd396b37c031440 - MD5:
d86cb43af7bdee2f6dd0c4c4040da6c0 - ssdeep:
768:hXgGzpD8p4ZYlI+sNNdSJW5ha27c4j5vsDMLkYPdL4heZJT1wrFhyw:yGFQp4Z4RsNbSJWjZ5UDakYPdLG82rFb - TLSH:
T143327EF310D7ED8C7A8A2703AEAB115A618AD349612697A010C47B2DC4FC6FD2F11A65 - Submitted as: normal_5f95b9e1c8160.pdf
- File type: pdf · Size: 46051 bytes
- Verdict: malicious (75/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://vixijusodu.weebly.com/uploads/1/3/0/7/130776714/xetezarozoforaboron.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ttraff.club/123?keyword=download+photo+movie+maker+for+android, https://delutezebojuk.weebly.com/uploads/1/3/4/3/134353455/1816188.pdf, https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/tebavu_mofevuz_punoxibera_gijipomole.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.club/123?keyword=download+photo+movie+maker+for+android
- https://delutezebojuk.weebly.com/uploads/1/3/4/3/134353455/1816188.pdf
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/tebavu_mofevuz_punoxibera_gijipomole.pdf
- https://lesuwigiwojan.weebly.com/uploads/1/3/4/3/134309114/xupemujabupotu-goteguvisafuxe.pdf
- https://korodaziso.weebly.com/uploads/1/3/0/7/130740443/355464.pdf
- https://zavomori.weebly.com/uploads/1/3/4/3/134335150/raxafaviselawa.pdf
- https://vixijusodu.weebly.com/uploads/1/3/0/7/130776714/xetezarozoforaboron.pdf
- https://uploads.strikinglycdn.com/files/280e933a-976a-421b-ab04-0dec340f7add/nufafu.pdf
- https://uploads.strikinglycdn.com/files/afe81d81-ae65-455a-b89f-d631a60c1b4f/96270484088.pdf
- https://uploads.strikinglycdn.com/files/2a6181fa-e1f0-41e8-abdf-1ae51e51c6c3/dipopodorijujibi.pdf
- https://uploads.strikinglycdn.com/files/72d7ddd6-3711-4a50-8155-1aa88ee80659/jasomasekum.pdf
- https://uploads.strikinglycdn.com/files/a40913bf-f013-4f4d-b509-cc5292aed878/rarumemuraxe.pdf
- https://xadaxiwunitari.weebly.com/uploads/1/3/0/8/130814235/7515953.pdf
- https://gomemetunugup.weebly.com/uploads/1/3/2/7/132712315/sotorirazajedi-turajotatufa-rosuw.pdf
- https://goraworozegisu.weebly.com/uploads/1/3/4/3/134324811/puwaxizibel_jejiviludugin_puveri.pdf
- https://vixijusodu.weebly.com/uploads/1/3/0/7/130776714/09919293.pdf
- https://besavikeneg.weebly.com/uploads/1/3/2/8/132815808/221977.pdf
- https://wekubuzebebam.weebly.com/uploads/1/3/0/7/130739705/6122828a3df2f33.pdf
- https://uploads.strikinglycdn.com/files/2b3f8ba6-51f0-4fff-b271-d87b16faa156/deep_six_lateral_rotators.pdf
- https://uploads.strikinglycdn.com/files/f6b4c06e-a4b8-4ff3-848f-63f0f4ceafe8/genetics_notes_download.pdf
- https://uploads.strikinglycdn.com/files/1125b013-0a74-4272-96fd-679aeecc147e/79664059913.pdf
- https://uploads.strikinglycdn.com/files/f8bcfc66-fc37-40ba-b132-960e7c30a2d0/jevafiwotatimam.pdf
- https://uploads.strikinglycdn.com/files/e0f9dd78-8da1-4f3f-a130-f91547866139/97769366629.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- ttraff.club
- delutezebojuk.weebly.com
- keniwuki.weebly.com
- lesuwigiwojan.weebly.com
- korodaziso.weebly.com
- zavomori.weebly.com
- vixijusodu.weebly.com
- uploads.strikinglycdn.com
- xadaxiwunitari.weebly.com
- gomemetunugup.weebly.com
- goraworozegisu.weebly.com
- besavikeneg.weebly.com
- wekubuzebebam.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report