SUSPICIOUS — sudodo.pdf
SUSPICIOUS — sudodo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
1a263f59ef761a38f650673a4dc511bbab11c60fb4159940ffc7a2f05cc0a483 - SHA-1:
a9ff68a228df2e0cd4d08aa2a666eb0fe0fa80ba - MD5:
974c64ad3649fe940a3e9059a8dedb34 - ssdeep:
768:2GgGzpDeJS/CAye7+sYezmo6YzJ0MD+xmG2mmUCgdq1yFQBy6zOtdAisVcB0:AGFKDE+sY3LYey+xmhmmUhdb8Ktd7kcy - TLSH:
T149329DF380ABED4C7A825B07ACEB1055608AD78C717297A04998373DD4BC6BDAE10D21 - Submitted as: sudodo.pdf
- File type: pdf · Size: 44620 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=spirituality+definition+pdf, https://site-1036760.mozfiles.com/files/1036760/xewividoxifelosime.pdf, https://site-1036815.mozfiles.com/files/1036815/13493011763.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/strik?keyword=spirituality+definition+pdf
- https://site-1036760.mozfiles.com/files/1036760/xewividoxifelosime.pdf
- https://site-1036815.mozfiles.com/files/1036815/13493011763.pdf
- https://site-1036772.mozfiles.com/files/1036772/6781532270.pdf
- https://site-1038660.mozfiles.com/files/1038660/14790618386.pdf
- https://site-1036941.mozfiles.com/files/1036941/58850468658.pdf
- https://uploads.strikinglycdn.com/files/b50340d9-00f5-4778-bf9f-15bc8c2c13ff/70815042757.pdf
- https://uploads.strikinglycdn.com/files/8993ae4c-0817-40ed-a64d-7db956048bad/91613632881.pdf
- https://uploads.strikinglycdn.com/files/1eec035e-27f8-4530-8047-48626d8ed092/6986491929.pdf
- https://uploads.strikinglycdn.com/files/170136a5-fb0a-446f-b66d-2a493ecc827d/rimuxonilenidarotatowu.pdf
- https://uploads.strikinglycdn.com/files/d0916a17-f29a-4364-9e04-377ff8f0d1f7/62356851674.pdf
- https://site-1038901.mozfiles.com/files/1038901/rufefowiriwukubopaxova.pdf
- https://site-1038338.mozfiles.com/files/1038338/47000248747.pdf
- https://site-1036680.mozfiles.com/files/1036680/4769151190.pdf
- https://site-1036644.mozfiles.com/files/1036644/19841971460.pdf
- http://files.thewineswirler.com/uploads/1/3/2/7/132740267/eedbc0bb9f6fd32.pdf
- http://vamim.appledentaleducation.com/uploads/1/3/0/8/130814761/4d8cd919a359.pdf
- http://files.897788976207812023.com/uploads/1/3/2/6/132683267/lelolowosir-wurezafawaruf.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- site-1036760.mozfiles.com
- site-1036815.mozfiles.com
- site-1036772.mozfiles.com
- site-1038660.mozfiles.com
- site-1036941.mozfiles.com
- uploads.strikinglycdn.com
- site-1038901.mozfiles.com
- site-1038338.mozfiles.com
- site-1036680.mozfiles.com
- site-1036644.mozfiles.com
- files.thewineswirler.com
- vamim.appledentaleducation.com
- files.897788976207812023.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report