SUSPICIOUS — jevidozobezapet.pdf
SUSPICIOUS — jevidozobezapet.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
114bfb894fd2db9f47946c36a59c8a991f7c52e060d0ed317f01a09fc1c7f2a4 - SHA-1:
ef16b0302eb1895fd75a3cbec0bc160b713c2071 - MD5:
9c430c5a088f0606b7ccec4cb0883f4d - ssdeep:
768:3gGzpDZvnh8PyWiAy4tOZtwGtWLKa+3OAmSyKd+74EsnymD:QGFNKy4SvWLK5Vf+s9nymD - TLSH:
T17132AFF31097ED4C67CB1F036AEA11A96049C38D612297A068D8773DD4B87FDAF40962 - Submitted as: jevidozobezapet.pdf
- File type: pdf · Size: 45122 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: http://files.distinctchurch.com/uploads/1/3/2/3/132303270/volomigonebasim.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=ssc+annual+planner+2019+to+2020+pdf, https://cdn.shopify.com/s/files/1/0439/4336/2715/files/hero3_black_manual.pdf, https://cdn.shopify.com/s/files/1/0488/4565/2133/files/lozarekukeronedujuzob.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/strik?keyword=ssc+annual+planner+2019+to+2020+pdf
- https://cdn.shopify.com/s/files/1/0439/4336/2715/files/hero3_black_manual.pdf
- https://cdn.shopify.com/s/files/1/0488/4565/2133/files/lozarekukeronedujuzob.pdf
- https://cdn.shopify.com/s/files/1/0432/1135/8369/files/puraf.pdf
- https://cdn.shopify.com/s/files/1/0481/1862/8505/files/61868531058.pdf
- https://cdn.shopify.com/s/files/1/0439/0099/3704/files/ziferonuv.pdf
- http://tuvarof.alissahartenbaum.com/uploads/1/3/1/3/131379174/ab14658.pdf
- http://wumowok.tom-lane.com/uploads/1/3/2/7/132740778/1668969.pdf
- http://files.distinctchurch.com/uploads/1/3/2/3/132303270/volomigonebasim.pdf
- http://nekubaw.trainingourprotectors.com/uploads/1/3/1/4/131407406/zalowawepe_gadura_bizugisojakataz.pdf
- https://site-1036880.mozfiles.com/files/1036880/navumutokowatuzavu.pdf
- https://site-1042624.mozfiles.com/files/1042624/61112888595.pdf
- https://site-1036867.mozfiles.com/files/1036867/16218971588.pdf
- https://site-1038402.mozfiles.com/files/1038402/vagasizu.pdf
- https://site-1038670.mozfiles.com/files/1038670/93932496991.pdf
- https://site-1036909.mozfiles.com/files/1036909/84475982330.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- cdn.shopify.com
- tuvarof.alissahartenbaum.com
- wumowok.tom-lane.com
- files.distinctchurch.com
- nekubaw.trainingourprotectors.com
- site-1036880.mozfiles.com
- site-1042624.mozfiles.com
- site-1036867.mozfiles.com
- site-1038402.mozfiles.com
- site-1038670.mozfiles.com
- site-1036909.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report