SUSPICIOUS — fewafirudurolud.pdf

SUSPICIOUS — fewafirudurolud.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 454a7b1346c2981db48986a9d76dc3a7027e76c85f1142acdf3d08e942146d48
• SHA-1: 2a04e6c1ef202298b39824262b6cf83ab0a255b6
• MD5: 0d11ff2d6613b831bf2fac4ef86cd2e7
• ssdeep: 768:JgGzpDtp8+kKu9Y58k0h4YYtfib2GW+/cyG7HQgs9cjGVu6jf:qGFBp8uu9Y5B0OYYti2Gx8D09cjGU6jf
• TLSH: T1D731AFF391B7ED8C768B6B136DA60008614AD78C3132A6E055D87BBCC5686FC7E50E21
• Submitted as: fewafirudurolud.pdf
• File type: pdf · Size: 40163 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=pokemon+insurgence+rare+candy+locations, https://site-1048454.mozfiles.com/files/1048454/91873165546.pdf, https://site-1040124.mozfiles.com/files/1040124/tobob.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=pokemon+insurgence+rare+candy+locations
• https://site-1048454.mozfiles.com/files/1048454/91873165546.pdf
• https://site-1040124.mozfiles.com/files/1040124/tobob.pdf
• https://site-1048275.mozfiles.com/files/1048275/lupaw.pdf
• http://lapus.blendedlearningcookbook.com/uploads/1/3/1/3/131384081/wagifupere.pdf
• http://vaxeli.honesthomeinspector.com/uploads/1/3/1/0/131070197/8dcb1.pdf
• http://woboti.salinakennelclub.com/uploads/1/3/0/8/130874388/zawokulura.pdf
• http://zatuv.northernnevadaclassicscarclub.com/uploads/1/3/0/7/130776023/7b09f.pdf
• http://xefuwo.thefreshproduce.net/uploads/1/3/1/8/131856293/vamanizoku_ravugokapegu.pdf
• https://site-1036750.mozfiles.com/files/1036750/gokenugodoz.pdf
• https://site-1038572.mozfiles.com/files/1038572/15878752402.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• site-1048454.mozfiles.com
• site-1040124.mozfiles.com
• site-1048275.mozfiles.com
• lapus.blendedlearningcookbook.com
• vaxeli.honesthomeinspector.com
• woboti.salinakennelclub.com
• zatuv.northernnevadaclassicscarclub.com
• xefuwo.thefreshproduce.net
• site-1036750.mozfiles.com
• site-1038572.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report