SUSPICIOUS — apwh_dbq_rubric.pdf
SUSPICIOUS — apwh_dbq_rubric.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
089e17345be0c1e978d459dc4aac59577935713eda69fd216a9335c2a35dc724 - SHA-1:
dd2551b045b8868d7226ff1f85a67da1a5d87297 - MD5:
15cea7704e81697b20388bc5304c6f46 - ssdeep:
1536:iGFkpWZzsOnw8vTyKfQe+cXtZSQ9jSIWhtSg/:bFkpWRBNTyKoebtUQ9jSnj - TLSH:
T1E1348DF31097DCCD7BCBAB036AAB11599087D7486136AA90458C7B6CC47CAECBF10A51 - Submitted as: apwh_dbq_rubric.pdf
- File type: pdf · Size: 54038 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/6b078209-77eb-481d-8d8a-86837a35c67f/lutejiramapupoxojo.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=apwh+dbq+rubric, https://uploads.strikinglycdn.com/files/6b078209-77eb-481d-8d8a-86837a35c67f/lutejiramapupoxojo.pdf, https://uploads.strikinglycdn.com/files/d1d52d4e-93c1-4eb0-b967-74072951a0a5/bidijifexerefel.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://gettraff.ru/strik?keyword=apwh+dbq+rubric
- https://uploads.strikinglycdn.com/files/6b078209-77eb-481d-8d8a-86837a35c67f/lutejiramapupoxojo.pdf
- https://uploads.strikinglycdn.com/files/d1d52d4e-93c1-4eb0-b967-74072951a0a5/bidijifexerefel.pdf
- https://uploads.strikinglycdn.com/files/759cb58f-48c3-4ade-8bfd-ceb52717fb7b/rasebumekutoloxe.pdf
- https://uploads.strikinglycdn.com/files/039c52bd-961a-4b17-80ba-197a7dd02c43/xixutitisavez.pdf
- https://uploads.strikinglycdn.com/files/6b8c187a-c9de-4a8e-ae6c-857180d0ecb7/59401801301.pdf
- https://cdn.shopify.com/s/files/1/0498/0585/2834/files/62913871753.pdf
- https://cdn.shopify.com/s/files/1/0427/9864/5404/files/fipugazobawup.pdf
- https://cdn.shopify.com/s/files/1/0495/7716/4956/files/42702124128.pdf
- https://cdn.shopify.com/s/files/1/0483/9515/7662/files/2188722109.pdf
- https://cdn.shopify.com/s/files/1/0495/7313/4492/files/81607304576.pdf
- https://cdn.shopify.com/s/files/1/0481/4513/7826/files/29645830009.pdf
- https://cdn.shopify.com/s/files/1/0476/8628/7519/files/68539550960.pdf
- https://cdn.shopify.com/s/files/1/0431/9802/1793/files/31452365322.pdf
- https://cdn.shopify.com/s/files/1/0485/0076/8930/files/kotadowosajup.pdf
- https://cdn.shopify.com/s/files/1/0479/3591/4140/files/lolesoxanep.pdf
- https://cdn.shopify.com/s/files/1/0484/8720/2971/files/the_teenagers_guide_to_the_real_world.pdf
- https://cdn.shopify.com/s/files/1/0498/7571/4209/files/27585113789.pdf
- https://cdn.shopify.com/s/files/1/0431/9081/2821/files/formulae_and_tables_for_actuarial_examinations_2002.pdf
- https://cdn.shopify.com/s/files/1/0503/0874/3351/files/android_automation_testing_appium.pdf
- https://cdn.shopify.com/s/files/1/0430/3699/9842/files/37553483016.pdf
- https://s3.amazonaws.com/tadovu/81502766397.pdf
- https://s3.amazonaws.com/susopuzupure/79986821674.pdf
- https://gozofuma.weebly.com/uploads/1/3/0/8/130874065/fokon_sajevepebi_xijonibevetid.pdf
- https://riragojefo.weebly.com/uploads/1/3/1/8/131857115/kuzataro-dulode-saniti.pdf
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- s3.amazonaws.com
- gozofuma.weebly.com
- riragojefo.weebly.com
- bafovulik.weebly.com
- viweposedijul.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report