MALICIOUS — lajofaxifavugojanup.pdf

MALICIOUS — lajofaxifavugojanup.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 3867be4676224e3f8eddcec7f2bb19c8dc1e30ce31b3bd5bd82197964ab605b0
• SHA-1: cca63350ec31a82e16bde01d0c1c16182ae40390
• MD5: 421063aa3c4a7e08ef6b43dcdad3de3f
• ssdeep: 1536:ZGFYANEyeWK/NXluboj8CkdiySMSQpZryXOg5:sFYdfB/NXluQIUCpkN
• TLSH: T1B235D0F36587ED4C6A976713ACA90089518AC3C87177E3A468C9376CC0B89BC6F41CB1
• Submitted as: lajofaxifavugojanup.pdf
• File type: pdf · Size: 60422 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=chromic+acid+anodizing+pdf, http://jarudu.katy17.com/uploads/1/3/1/8/131871486/2773943.pdf, http://files.jaynewalther.com/uploads/1/3/2/7/132740595/1512ba4.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/strik?keyword=chromic+acid+anodizing+pdf
• http://jarudu.katy17.com/uploads/1/3/1/8/131871486/2773943.pdf
• http://files.jaynewalther.com/uploads/1/3/2/7/132740595/1512ba4.pdf
• http://files.madebymikky.com/uploads/1/3/1/6/131607131/2a27ddb1a0271.pdf
• http://fizagi.traciebartonbarrett.com/uploads/1/3/1/6/131636601/bizatiwaxawofu_xufeso_poluxuveto.pdf
• http://files.sparkfoundation.ca/uploads/1/3/1/4/131453823/8738578.pdf
• http://files.st-anthony.net/uploads/1/3/0/7/130776255/1451067.pdf
• http://novepad.highfivesflyball.com/uploads/1/3/0/8/130814174/xasebumimo-ketenadumu.pdf
• https://site-1037125.mozfiles.com/files/1037125/94207283923.pdf
• https://site-1037191.mozfiles.com/files/1037191/danixekofoluxipuvebix.pdf
• https://site-1037187.mozfiles.com/files/1037187/wafugalanowitiroregogo.pdf
• https://site-1036783.mozfiles.com/files/1036783/bogibamejapuxuxavov.pdf
• https://site-1036719.mozfiles.com/files/1036719/kuxolokujef.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• jarudu.katy17.com
• files.jaynewalther.com
• files.madebymikky.com
• fizagi.traciebartonbarrett.com
• files.sparkfoundation.ca
• files.st-anthony.net
• novepad.highfivesflyball.com
• site-1037125.mozfiles.com
• site-1037191.mozfiles.com
• site-1037187.mozfiles.com
• site-1036783.mozfiles.com
• site-1036719.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report