SUSPICIOUS — kajaduvozigo.pdf
SUSPICIOUS — kajaduvozigo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
382c84d216351666e4be9a733a90804956218072e25fb7f67a7e25e0e5fc6f8e - SHA-1:
c5676eeb09a6f006b2b8890a31e5b4e19b8be276 - MD5:
39606e68426f269a2dcea5ff341c2e5f - ssdeep:
1536:eGFbzVWPj+c0nksw+SXz7B6T1E0gAkg3rGj+z6T:HFbzQj/0nks0XzdcE0XGCK - TLSH:
T17536D0F35177DE8C7ACA9B439EE20148119AD7CCA123AAD095DC6B6CD8381BCBF01915 - Submitted as: kajaduvozigo.pdf
- File type: pdf · Size: 64539 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=shakta+agamas+pdf, https://site-1036929.mozfiles.com/files/1036929/xovugawanupifoxiwuwo.pdf, https://site-1036661.mozfiles.com/files/1036661/nidipegidewapufunosela.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/strik?keyword=shakta+agamas+pdf
- https://site-1036929.mozfiles.com/files/1036929/xovugawanupifoxiwuwo.pdf
- https://site-1036661.mozfiles.com/files/1036661/nidipegidewapufunosela.pdf
- https://site-1036640.mozfiles.com/files/1036640/disuwiw.pdf
- https://site-1036826.mozfiles.com/files/1036826/25411994368.pdf
- https://site-1038880.mozfiles.com/files/1038880/74379465379.pdf
- https://site-1037902.mozfiles.com/files/1037902/29960841107.pdf
- https://site-1036751.mozfiles.com/files/1036751/615437030.pdf
- http://jesavilid.bnrcreativealuminum.com/uploads/1/3/0/8/130873982/56d6ab541474df.pdf
- http://files.thekungfuacademy.org/uploads/1/3/1/8/131856392/4222689.pdf
- http://jelizin.memorialbusinessday.com/uploads/1/3/0/7/130738524/41387.pdf
- http://fovono.ziontbc.com/uploads/1/3/1/8/131856149/gokufumuxub_vifuk_zotogesofuda.pdf
- http://files.discoveringsarah.com/uploads/1/3/1/0/131069987/vejupevujow_zopamuluki_vifasapejezogu_lozanibumew.pdf
- http://files.wacg.info/uploads/1/3/2/3/132303229/cceb0c87.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- site-1036929.mozfiles.com
- site-1036661.mozfiles.com
- site-1036640.mozfiles.com
- site-1036826.mozfiles.com
- site-1038880.mozfiles.com
- site-1037902.mozfiles.com
- site-1036751.mozfiles.com
- jesavilid.bnrcreativealuminum.com
- files.thekungfuacademy.org
- jelizin.memorialbusinessday.com
- fovono.ziontbc.com
- files.discoveringsarah.com
- files.wacg.info
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report