MALICIOUS — normal_5f99250e17194.pdf
MALICIOUS — normal_5f99250e17194.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
edf639453505825300921dd9a11cb574020063e79b1a35287abf2ad7fe29bb8f - SHA-1:
0f86aef84bd50a45778aba538f153ac681768400 - MD5:
0130f1f58c7f04c31aae12e1b27d02c6 - ssdeep:
1536:FGFPpqoE1o6khVGYYZy4z40ljDVn4qovrOZO:YFPpqoayZYz4MjDV4LD7 - TLSH:
T15D349EF351A7DD8D39C7DB435AEA2558608AD688723287508588BB2CC4BC27D7F11A21 - Submitted as: normal_5f99250e17194.pdf
- File type: pdf · Size: 56108 bytes
- Verdict: malicious (75/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://gomemetunugup.weebly.com/uploads/1/3/2/7/132712315/cc18584a1f3.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ttraff.link/123?keyword=camas+de+madera+para+ni%25C3%25B1as, https://naxedomabaxa.weebly.com/uploads/1/3/1/6/131606472/warujepulubawa.pdf, https://gomemetunugup.weebly.com/uploads/1/3/2/7/132712315/cc18584a1f3.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.link/123?keyword=camas+de+madera+para+ni%25C3%25B1as
- https://naxedomabaxa.weebly.com/uploads/1/3/1/6/131606472/warujepulubawa.pdf
- https://gomemetunugup.weebly.com/uploads/1/3/2/7/132712315/cc18584a1f3.pdf
- https://bigogewoxof.weebly.com/uploads/1/3/0/7/130739615/munonomisiwin.pdf
- https://pexazunawilaga.weebly.com/uploads/1/3/4/2/134265520/8549457.pdf
- https://uploads.strikinglycdn.com/files/15b8f1fa-3298-4930-809c-d83e490f9cfa/90314855551.pdf
- https://uploads.strikinglycdn.com/files/f08e5e88-6949-4a75-bdf0-ad853aeb9bb9/34844274563.pdf
- https://uploads.strikinglycdn.com/files/5b281f3b-cc7c-4ccf-8616-1b7fd9c61d8e/93825472767.pdf
- https://uploads.strikinglycdn.com/files/77680c35-214d-4792-b417-2730b5beb0e4/sibaxineliwe.pdf
- https://uploads.strikinglycdn.com/files/a825b202-382a-4da4-9a5b-f8b5508f7238/vijirigeribifino.pdf
- https://cdn.shopify.com/s/files/1/0482/2207/7085/files/35413405989.pdf
- https://cdn.shopify.com/s/files/1/0437/6612/0609/files/21508075914.pdf
- https://nikokabiliru.weebly.com/uploads/1/3/1/4/131409463/bd564690e8102.pdf
- https://xujebope.weebly.com/uploads/1/3/4/0/134018561/7326536.pdf
- https://bogadisosupotaj.weebly.com/uploads/1/3/0/7/130776541/9517850.pdf
- https://rikisuluwujufa.weebly.com/uploads/1/3/1/4/131452938/89869.pdf
- https://xigodawi.weebly.com/uploads/1/3/4/4/134464905/mujabogufewefib_zogotomawimepid_wisobes_mogijov.pdf
- https://cdn-cms.f-static.net/uploads/4370064/normal_5f87f0fcd2a45.pdf
- https://cdn-cms.f-static.net/uploads/4370547/normal_5f97e569a6c9a.pdf
- https://cdn-cms.f-static.net/uploads/4381737/normal_5f8c8a6043f99.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- ttraff.link
- naxedomabaxa.weebly.com
- gomemetunugup.weebly.com
- bigogewoxof.weebly.com
- pexazunawilaga.weebly.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- nikokabiliru.weebly.com
- xujebope.weebly.com
- bogadisosupotaj.weebly.com
- rikisuluwujufa.weebly.com
- xigodawi.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report