MALICIOUS — ddlg_little_rules.pdf

MALICIOUS — ddlg_little_rules.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 16fb34027b36bee8bf43ebcebcbd0d70c224c8e37df7a45acd0285c1ab02804b
• SHA-1: 7896980570f9e512e0f19117fe842ce50aef00e9
• MD5: 11ed5e8122e71b31699e18a161446a96
• ssdeep: 1536:9ekP/NmoQFemRfhksAmo0xKf2eQIx6a4UguPHWA828zMZJ:1nNmoQYmp6sjo0St7x/hJPMJzm
• TLSH: T18637D0F3328BDE8D3A879B53FAE710196596DAC97532A9A00084B37DD47C1BD6E10E10
• Submitted as: ddlg_little_rules.pdf
• File type: pdf · Size: 74157 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafftec.ru/strik?utm_term=ddlg+little+rules, https://uploads.strikinglycdn.com/files/a6e80e51-f0a3-4f9d-b6b1-4890629b754e/buvumov.pdf, https://walijogopabo.weebly.com/uploads/1/3/0/7/130776167/gegakunagakamet-wipumidujo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafftec.ru/strik?utm_term=ddlg+little+rules
• https://uploads.strikinglycdn.com/files/a6e80e51-f0a3-4f9d-b6b1-4890629b754e/buvumov.pdf
• https://s3.amazonaws.com/votawawo/mikabeledulomiragov.pdf
• https://walijogopabo.weebly.com/uploads/1/3/0/7/130776167/gegakunagakamet-wipumidujo.pdf
• https://foposivore.weebly.com/uploads/1/3/4/4/134472686/sajezubonisafivalex.pdf
• https://s3.amazonaws.com/zonivezada/12707100115.pdf
• https://s3.amazonaws.com/wozoxub/26813864675.pdf
• https://vekaluledezo.weebly.com/uploads/1/3/4/2/134235689/6328592.pdf
• https://cdn-cms.f-static.net/uploads/4427781/normal_5fa3c5f31c2be.pdf
• https://folukufisika.weebly.com/uploads/1/3/1/3/131384255/xigokani-nubakatabuvik-negivufosa-xujagem.pdf
• https://s3.amazonaws.com/zetare/67549421631.pdf
• https://s3.amazonaws.com/zalomi/69403588057.pdf
• https://sisodiwitamusoz.weebly.com/uploads/1/3/2/6/132681746/5090826.pdf
• https://cdn-cms.f-static.net/uploads/4392668/normal_5f96764c0fd06.pdf
• https://s3.amazonaws.com/gosete/kogadino.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafftec.ru
• uploads.strikinglycdn.com
• s3.amazonaws.com
• walijogopabo.weebly.com
• foposivore.weebly.com
• vekaluledezo.weebly.com
• cdn-cms.f-static.net
• folukufisika.weebly.com
• sisodiwitamusoz.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report