MALICIOUS — d1ce4.pdf
MALICIOUS — d1ce4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
fe33afca98a2b58589d39dbf07d525dfb9a880234b29deb4a81f449a8f419657 - SHA-1:
1b4eae5479309c3a1a41b738c55da70f58eccf4b - MD5:
9f6c7837ebb17c443909fc8bef8522cd - ssdeep:
768:GgGzpDtejbRFV4lhVHTuH4PG82nQmuQE/WagckGJgEQP:TGFxejbIVzuYPAFuQE/WvckGJ/QP - TLSH:
T11F359EF310A7ED8C7B8AAB536DAB1459208ADB8C6036D6A055C8373CC57C6BD7D11E10 - Submitted as: d1ce4.pdf
- File type: pdf · Size: 60963 bytes
- Verdict: malicious (75/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/b4b3eb38b.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=tampines%20street%2083, https://wivupenoremew.weebly.com/uploads/1/3/0/7/130775018/nifelez-nowajafeda.pdf, https://xebikazogede.weebly.com/uploads/1/3/2/7/132740990/gozesimoruwawe.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=tampines%20street%2083
- https://wivupenoremew.weebly.com/uploads/1/3/0/7/130775018/nifelez-nowajafeda.pdf
- https://xebikazogede.weebly.com/uploads/1/3/2/7/132740990/gozesimoruwawe.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/b4b3eb38b.pdf
- https://narogigadi.weebly.com/uploads/1/3/0/8/130874066/7025f8b8a2.pdf
- https://jiwepurojal.weebly.com/uploads/1/3/0/7/130775762/8626484.pdf
- https://site-1038439.mozfiles.com/files/1038439/25911151377.pdf
- https://site-1039645.mozfiles.com/files/1039645/dedasunuw.pdf
- https://site-1042985.mozfiles.com/files/1042985/construction_industry_scheme_reform_manual.pdf
- https://site-1038401.mozfiles.com/files/1038401/majirivimoba.pdf
- https://uploads.strikinglycdn.com/files/14dac420-bd09-4ce1-95bc-b407c2df420f/lewapewuginufugimejawa.pdf
- https://uploads.strikinglycdn.com/files/8acb20cd-846a-461e-8056-9069dd76dc4b/73846356313.pdf
- https://uploads.strikinglycdn.com/files/14118cdf-4072-46d8-88d5-e3fccb9601c7/56040250548.pdf
- https://uploads.strikinglycdn.com/files/e018968f-9718-4b26-8d9b-e91851f7f1d7/17150538443.pdf
- https://site-1043456.mozfiles.com/files/1043456/39841170202.pdf
- https://site-1040142.mozfiles.com/files/1040142/86229226474.pdf
- https://site-1043091.mozfiles.com/files/1043091/98343839291.pdf
- https://site-1038861.mozfiles.com/files/1038861/domopu.pdf
- https://site-1042266.mozfiles.com/files/1042266/tujuzikututisedimajif.pdf
- https://site-1042270.mozfiles.com/files/1042270/99657474842.pdf
- https://site-1038414.mozfiles.com/files/1038414/8904033143.pdf
- https://site-1039510.mozfiles.com/files/1039510/tekutavaxafetevasizejex.pdf
- https://saxexowiki.weebly.com/uploads/1/3/0/9/130969873/dimejozepewuwu.pdf
- https://lotagixowila.weebly.com/uploads/1/3/1/1/131164100/fozefinowaweko.pdf
- https://lagukekejase.weebly.com/uploads/1/3/0/8/130815031/wusinaje_zeluze_fudakatulizix.pdf
Embedded domains
- gettraff.ru
- wivupenoremew.weebly.com
- xebikazogede.weebly.com
- gimejexoxixaza.weebly.com
- narogigadi.weebly.com
- jiwepurojal.weebly.com
- site-1038439.mozfiles.com
- site-1039645.mozfiles.com
- site-1042985.mozfiles.com
- site-1038401.mozfiles.com
- uploads.strikinglycdn.com
- site-1043456.mozfiles.com
- site-1040142.mozfiles.com
- site-1043091.mozfiles.com
- site-1038861.mozfiles.com
- site-1042266.mozfiles.com
- site-1042270.mozfiles.com
- site-1038414.mozfiles.com
- site-1039510.mozfiles.com
- saxexowiki.weebly.com
- lotagixowila.weebly.com
- lagukekejase.weebly.com
- xubuvene.weebly.com
- xipunozelizu.weebly.com
- www.w3.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report