SUSPICIOUS — rixuganojokiwomovopiz.pdf

SUSPICIOUS — rixuganojokiwomovopiz.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 1e5bf4f34b8e2bbd193993831144ff3b10a144969e497edfee9c22cee36c3bad
• SHA-1: 82bfff48f31491fcad5933995e3d9333b0f6869b
• MD5: 1a4d970b17d6887f2d49d3d48069d225
• ssdeep: 768:kgGzpDwjtuFXokBlw7Fbhbk0lxFptvbL9PEAWcy1OWjI8yJEk:RGFUjt4fBObLmAWcy0+fyJEk
• TLSH: T12C318DF351A7EC8D3A8BAB037EF61069544AD6887032D6B059C87B6CD4787FD2E00A51
• Submitted as: rixuganojokiwomovopiz.pdf
• File type: pdf · Size: 41949 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=albigen+system+pdf, https://cdn.shopify.com/s/files/1/0429/4426/6399/files/african_traditional_beliefs.pdf, https://cdn.shopify.com/s/files/1/0448/1345/1430/files/data_warehouse_toolkit_3rd_edition_free.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/strik?keyword=albigen+system+pdf
• https://cdn.shopify.com/s/files/1/0429/4426/6399/files/african_traditional_beliefs.pdf
• https://cdn.shopify.com/s/files/1/0448/1345/1430/files/data_warehouse_toolkit_3rd_edition_free.pdf
• https://cdn.shopify.com/s/files/1/0435/5509/4689/files/arduino_programming_notebook_edicion_espaola.pdf
• https://cdn.shopify.com/s/files/1/0432/4674/7803/files/super_mario_crossover_2_unblocked.pdf
• https://cdn.shopify.com/s/files/1/0429/1906/7815/files/ptx_evolution_of_music_sheet_music.pdf
• http://files.connectionsthruart.com/uploads/1/3/2/7/132740558/mivipu.pdf
• http://files.bajaartcollective.com/uploads/1/3/1/4/131483632/virudir.pdf
• https://cdn.shopify.com/s/files/1/0432/3042/9352/files/disposiciones_legales_acerca_de_la_obligatoriedad_de_la_contabilidad.pdf
• https://cdn.shopify.com/s/files/1/0433/2430/9659/files/beautiful_hd_pictures.pdf
• https://cdn.shopify.com/s/files/1/0439/3975/8235/files/guia_autometrica_abril_2020.pdf
• https://cdn.shopify.com/s/files/1/0438/4410/8445/files/apology_mail_format_to_manager.pdf
• https://cdn.shopify.com/s/files/1/0431/9520/3745/files/51472832071.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• cdn.shopify.com
• files.connectionsthruart.com
• files.bajaartcollective.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report