MALICIOUS — luzejowanosiraxazu.pdf

MALICIOUS — luzejowanosiraxazu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 4d54653a48cecb130b0d9727a1485c85a115ba35d54a9c655b4b16ad85e2213f
SHA-1: 383993a33b25f1e2c55bb181cb3008d7db347ff9
MD5: 4522abdf281753a797104a0b25f3c382
ssdeep: 1536:lGFdJjLzy8AELiL1fTL30PA4oTmrO6AOhUJ27nO:4FdJzy6mz0PADTgOJD
TLSH: T12134BEF3A0ABDE8C7AC797836CF6014464459788766793B058C87AAD887C5FC7F10861
Submitted as: luzejowanosiraxazu.pdf
File type: pdf · Size: 52376 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gettraff.ru/strik?keyword=aneurisma+da+aorta+tor%25C3%25A1cica+pdf, https://uploads.strikinglycdn.com/files/2d9ace49-e64f-4864-9873-21f18f02aad9/dedegusejitoxezilamogegof.pdf, https://uploads.strikinglycdn.com/files/d5d7ba04-9cd1-49b4-9adb-3f450f923833/pusarevelisosititij.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://gettraff.ru/strik?keyword=aneurisma+da+aorta+tor%25C3%25A1cica+pdf
https://uploads.strikinglycdn.com/files/2d9ace49-e64f-4864-9873-21f18f02aad9/dedegusejitoxezilamogegof.pdf
https://uploads.strikinglycdn.com/files/d5d7ba04-9cd1-49b4-9adb-3f450f923833/pusarevelisosititij.pdf
https://uploads.strikinglycdn.com/files/1c28b3d0-ae15-44ea-b171-89e2c5006ddc/pekumulukisezonovaretej.pdf
https://uploads.strikinglycdn.com/files/74158946-1843-4af5-abcb-2f4ba05bcfe0/saguru.pdf
https://uploads.strikinglycdn.com/files/5f45c067-c21f-41ce-8172-34a37f299fd5/xesiremasivata.pdf
https://site-1036855.mozfiles.com/files/1036855/64838323514.pdf
https://site-1036941.mozfiles.com/files/1036941/xuzazaxanekatixu.pdf
https://site-1036744.mozfiles.com/files/1036744/zevemifofajolupew.pdf
https://site-1036833.mozfiles.com/files/1036833/39918464569.pdf
https://site-1037145.mozfiles.com/files/1037145/77109915819.pdf
https://site-1036753.mozfiles.com/files/1036753/vubozesewazobeputo.pdf
https://uploads.strikinglycdn.com/files/cb043b1b-480f-4b96-b13d-3a5e0a3f47a4/65066092905.pdf
https://uploads.strikinglycdn.com/files/8b368e1a-e166-4ae0-bc79-5a3f75aa9e93/vapekivujozosupofinimagi.pdf
https://uploads.strikinglycdn.com/files/e46de07d-5533-4234-bceb-c76a5fc2b077/beleralegegefuru.pdf
https://uploads.strikinglycdn.com/files/db7dd7b7-dff9-475f-8c8d-c31e32952c38/27152192281.pdf
https://uploads.strikinglycdn.com/files/de487abe-eabb-4751-8911-1c41774a8856/22423239822.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

gettraff.ru
uploads.strikinglycdn.com
site-1036855.mozfiles.com
site-1036941.mozfiles.com
site-1036744.mozfiles.com
site-1036833.mozfiles.com
site-1037145.mozfiles.com
site-1036753.mozfiles.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report