MALICIOUS — ladaginax.pdf

MALICIOUS — ladaginax.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 52 detection engines flagged it.

Identification

SHA-256: 04093d4d5cd10475e1b9389a19ee619ae022d96fb5bfc5aa540e107391291221
SHA-1: f8e887a80fef0873ba6a2c275261dde7f52a57ea
MD5: b29a1c99a26b78bd6f31e295b7c38370
ssdeep: 768:EEgGzpDPpxjG0JEtDs/TvFoPLpDPt1fWFL0xrbIby2SBv8wN:UGFLpxjEtQFoPLlPTWF0x/X2SBkwN
TLSH: T10E2F6CF3119BED9C7A9B9B075D96109A914AD38C6132E7A019CCBB3DC4BC6FC5E00921
Submitted as: ladaginax.pdf
File type: pdf · Size: 35124 bytes
Verdict: malicious (88/100)

Detections (3 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gettraff.ru/strik?keyword=options+futures+and+other+derivatives+solutions+manual+7th+edition+pdf, http://jagudux.reidgarcia.com/uploads/1/3/1/6/131636644/bezudemozugon.pdf, http://gubupu.fgofantasyphoto.com/uploads/1/3/1/6/131637131/daguzewidomexud-lafaget.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://gettraff.ru/strik?keyword=options+futures+and+other+derivatives+solutions+manual+7th+edition+pdf
http://jagudux.reidgarcia.com/uploads/1/3/1/6/131636644/bezudemozugon.pdf
http://gubupu.fgofantasyphoto.com/uploads/1/3/1/6/131637131/daguzewidomexud-lafaget.pdf
http://files.udmags.com/uploads/1/3/0/7/130776075/57fc665ad4.pdf
http://dojunob.frontporcharts.org/uploads/1/3/0/7/130775455/8b99c129fd.pdf
http://jemiw.audreyaliwarga.com/uploads/1/3/0/8/130874384/xafesifebedo.pdf
http://files.herdiselmend.com/uploads/1/3/0/8/130814311/nixuribibo.pdf
http://mizima.marshallmcmahen.com/uploads/1/3/2/3/132303012/4148931.pdf
http://lufudab.millantiques.com/uploads/1/3/0/8/130814729/lojirowi_wurozomavur_lonojomej_viretenuzapoge.pdf
http://nurir.fioga.org/uploads/1/3/2/6/132681763/4206782.pdf
http://vaxavaj.lakelandchoralsociety.org/uploads/1/3/1/4/131455508/68b5eb1e3720b8c.pdf
http://nutufokuk.rebeccagoldberg.net/uploads/1/3/1/3/131381806/5520150.pdf
http://files.bagusnugroho.com/uploads/1/3/1/3/131398547/4298754.pdf
http://files.kidshoeology.com/uploads/1/3/1/4/131437123/mukipamadede.pdf
http://giduxisit.brownnotgreen.com/uploads/1/3/1/6/131637136/doker.pdf
http://files.razielleaigen.com/uploads/1/3/1/4/131454733/tanexajazi.pdf
http://files.kahaboutique.com/uploads/1/3/0/8/130814758/d3913f110297095.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

gettraff.ru
jagudux.reidgarcia.com
gubupu.fgofantasyphoto.com
files.udmags.com
dojunob.frontporcharts.org
jemiw.audreyaliwarga.com
files.herdiselmend.com
mizima.marshallmcmahen.com
lufudab.millantiques.com
nurir.fioga.org
vaxavaj.lakelandchoralsociety.org
nutufokuk.rebeccagoldberg.net
files.bagusnugroho.com
files.kidshoeology.com
giduxisit.brownnotgreen.com
files.razielleaigen.com
files.kahaboutique.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report