MALICIOUS — sifigot.pdf

MALICIOUS — sifigot.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 3ca6f4c946014da40faba846063a0a67d0bb1c59d235c939dc7de692caa2322d
• SHA-1: 75d70709ef24a98a6009c2974c2974b207d66ef3
• MD5: a86e4babd280468e65b1b2caa0dbbdb5
• ssdeep: 384:EsFlS3K6XgKV7cAgdOpW+0IuWj3JquUbGhhzzbZaMOxW53VUgVHCUS4CbjXUpPyN:UgGzpD1x16WtziWpVUgdejXUqbReVw
• TLSH: T143309EF35067DE883A8BAF43AEEA11586095D24D6533A72018D8777CC87C6FCAF10961
• Submitted as: sifigot.pdf
• File type: pdf · Size: 36309 bytes
• Verdict: malicious (70/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=wh+questions+exercicios+resolvidos+pdf, https://site-1038622.mozfiles.com/files/1038622/32348869292.pdf, https://site-1038482.mozfiles.com/files/1038482/xudipexi.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=wh+questions+exercicios+resolvidos+pdf
• https://site-1038622.mozfiles.com/files/1038622/32348869292.pdf
• https://site-1038482.mozfiles.com/files/1038482/xudipexi.pdf
• https://site-1039180.mozfiles.com/files/1039180/bogukijeruramu.pdf
• https://site-1043170.mozfiles.com/files/1043170/poramojon.pdf
• https://site-1037120.mozfiles.com/files/1037120/15481413749.pdf
• https://site-1039838.mozfiles.com/files/1039838/25916846608.pdf
• https://site-1042286.mozfiles.com/files/1042286/xaxeriwep.pdf
• https://site-1036962.mozfiles.com/files/1036962/vinazovesojajuxi.pdf
• http://zavaremez.sagercreektri.com/uploads/1/3/0/8/130874370/kinopedafona.pdf
• http://xubedeza.susieruthscott.com/uploads/1/3/0/7/130776138/firexozigojizax.pdf
• http://files.matasconsult.com/uploads/1/3/0/7/130775308/rejufawiwojager-vekul-wozovez.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• site-1038622.mozfiles.com
• site-1038482.mozfiles.com
• site-1039180.mozfiles.com
• site-1043170.mozfiles.com
• site-1037120.mozfiles.com
• site-1039838.mozfiles.com
• site-1042286.mozfiles.com
• site-1036962.mozfiles.com
• zavaremez.sagercreektri.com
• xubedeza.susieruthscott.com
• files.matasconsult.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report