MALICIOUS — normal_5f87b6e741a84.pdf
MALICIOUS — normal_5f87b6e741a84.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f0ec9efc889dd1984ac6e48e74d62d0d0dace69835150c72c8f53183762bf27e - SHA-1:
a9e93376aaabe350ad7763178e41fa8430d5d97b - MD5:
048b949b26bb9c89c5f92610a16cc8b2 - ssdeep:
768:sgGzpDKpDLrx4iuOdU1cvQ+Qnz8Fx/4tqx86qMFJMdMPMZj5cbW+MmNJNlhj+B9y:pGFWpLWz7L+PMZj5cZJVja9XC - TLSH:
T1E432AFF344DBDD4C7E8B8B039EEB205A5149C3886136D650988CBB3CC5BC6BDAE00961 - Submitted as: normal_5f87b6e741a84.pdf
- File type: pdf · Size: 45226 bytes
- Verdict: malicious (75/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://liwevapazu.weebly.com/uploads/1/3/1/0/131071299/1315167.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=casio+tough+solar+illuminator+watch+instructions, https://cdn.shopify.com/s/files/1/0496/3955/5225/files/waunakee_middle_school_attendance.pdf, https://cdn.shopify.com/s/files/1/0492/3041/3980/files/85090195614.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=casio+tough+solar+illuminator+watch+instructions
- https://cdn.shopify.com/s/files/1/0496/3955/5225/files/waunakee_middle_school_attendance.pdf
- https://cdn.shopify.com/s/files/1/0492/3041/3980/files/85090195614.pdf
- https://cdn.shopify.com/s/files/1/0500/3303/3366/files/pathfinder_half_dragon.pdf
- https://cdn.shopify.com/s/files/1/0496/6953/7956/files/nania_car_seat_instructions.pdf
- https://cdn.shopify.com/s/files/1/0437/4082/3706/files/pack_a_punch_classified.pdf
- https://cdn.shopify.com/s/files/1/0498/7276/5083/files/95088110865.pdf
- https://cdn.shopify.com/s/files/1/0502/8410/1804/files/57943335051.pdf
- https://cdn.shopify.com/s/files/1/0486/9341/1990/files/freckle_juice.pdf
- https://liwevapazu.weebly.com/uploads/1/3/1/0/131071299/1315167.pdf
- https://pigogokeda.weebly.com/uploads/1/3/1/8/131857695/ropis.pdf
- https://site-1038999.mozfiles.com/files/1038999/2129421430.pdf
- https://site-1038349.mozfiles.com/files/1038349/kiwagoret.pdf
- https://site-1036764.mozfiles.com/files/1036764/45034610262.pdf
- https://site-1037121.mozfiles.com/files/1037121/13907793702.pdf
- https://cdn.shopify.com/s/files/1/0502/7931/7701/files/regrouping_math_worksheets.pdf
- https://cdn.shopify.com/s/files/1/0434/5816/6949/files/deponia_doomsday_walkthrough_text.pdf
- https://uploads.strikinglycdn.com/files/0e55d547-9e0a-43a6-9bbc-17874264f13a/mowofozagakudosage.pdf
- https://uploads.strikinglycdn.com/files/64aa875e-4824-4801-a890-c8f1b6d52b89/vekufivemuge.pdf
- https://uploads.strikinglycdn.com/files/0446883b-5c4f-4f48-a370-e9536e7e972b/71294574097.pdf
- https://uploads.strikinglycdn.com/files/055c5e13-8b6f-489d-8dab-c54bf414fdc5/meratexuxomit.pdf
- https://uploads.strikinglycdn.com/files/7e48a062-396d-4eef-9ecd-e6544eb528e2/74758602471.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- liwevapazu.weebly.com
- pigogokeda.weebly.com
- site-1038999.mozfiles.com
- site-1038349.mozfiles.com
- site-1036764.mozfiles.com
- site-1037121.mozfiles.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report