SUSPICIOUS — kowitet-zitegisuja-robop-juzutug.pdf
SUSPICIOUS — kowitet-zitegisuja-robop-juzutug.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
3d6b42fd91c97d8cae1d7a28de9eebf38d6fccaab23c1f4fcb7f68588514d6af - SHA-1:
30e8439816fdd30f518c77989dd0627a2dc09a33 - MD5:
cb156b2a8751d2c2d58c0dbce7a2f8b9 - ssdeep:
1536:nGF3p7phO1jjDUvu6KNqMbxA1y2vFwmXhnp:GF3p7phsI2koAyaF7Rp - TLSH:
T1A836C0F31063EE4C3FCEAB579DE610997549DA8C512742A1098DB72CC5BC5FEAE00684 - Submitted as: kowitet-zitegisuja-robop-juzutug.pdf
- File type: pdf · Size: 66760 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://nipufijupetobug.weebly.com/uploads/1/3/1/4/131482996/7623055.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=journals%20of%20sylvia%20plath, https://nipufijupetobug.weebly.com/uploads/1/3/1/4/131482996/7623055.pdf, https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/7874459.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=journals%20of%20sylvia%20plath
- https://nipufijupetobug.weebly.com/uploads/1/3/1/4/131482996/7623055.pdf
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/7874459.pdf
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/lonevu.pdf
- https://bizetuxerupa.weebly.com/uploads/1/3/0/8/130873791/rabojujib.pdf
- https://vefoxetewezelir.weebly.com/uploads/1/3/1/4/131483279/f12a8.pdf
- https://polabufasol.weebly.com/uploads/1/3/2/8/132814050/6dad5b0e8faa.pdf
- https://xoraxabaxid.weebly.com/uploads/1/3/2/6/132682630/9302278.pdf
- https://kenilajapa.weebly.com/uploads/1/3/1/0/131069910/kajovuludutububedu.pdf
- https://purolejomi.weebly.com/uploads/1/3/0/7/130776639/7594813.pdf
- https://cdn-cms.f-static.net/uploads/4367643/normal_5f8783deced30.pdf
- https://cdn-cms.f-static.net/uploads/4369900/normal_5f89852cb474d.pdf
- https://cdn-cms.f-static.net/uploads/4366389/normal_5f8873ac04bb9.pdf
- https://cdn-cms.f-static.net/uploads/4375890/normal_5f89c462a6712.pdf
- https://cdn-cms.f-static.net/uploads/4369775/normal_5f8943a945696.pdf
- https://cdn.shopify.com/s/files/1/0484/6662/4666/files/oleanna_david_mamet_espaol.pdf
- https://cdn.shopify.com/s/files/1/0434/1746/9086/files/nitakogegorok.pdf
- https://cdn.shopify.com/s/files/1/0432/3088/8103/files/siwadedonugopuz.pdf
- https://cdn.shopify.com/s/files/1/0468/9975/7218/files/47213121852.pdf
- https://uploads.strikinglycdn.com/files/f65a59fa-46b5-4d30-81ed-b96b61f29f5d/84048907341.pdf
- https://uploads.strikinglycdn.com/files/567582ee-9a30-4768-9cca-329b91c06936/23851893515.pdf
- https://uploads.strikinglycdn.com/files/b5dc0feb-2e94-4d0b-8f46-ad3c8cded6a7/20428737504.pdf
- https://uploads.strikinglycdn.com/files/d490fc10-dbbb-4932-ab44-bbe5ea88a301/60529453364.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- cctraff.ru
- nipufijupetobug.weebly.com
- bedizegoresupa.weebly.com
- bizetuxerupa.weebly.com
- vefoxetewezelir.weebly.com
- polabufasol.weebly.com
- xoraxabaxid.weebly.com
- kenilajapa.weebly.com
- purolejomi.weebly.com
- cdn-cms.f-static.net
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report