SUSPICIOUS — kadidasililelivugus.pdf

SUSPICIOUS — kadidasililelivugus.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 4f643c9105ccf8a24104006d71e6ab949f49d96f77df331f5969c11d2efa0929
• SHA-1: 40b9e5b420474c5da2c3037b0de34eb29abe2755
• MD5: 57b5a90f1a954540dbecba0e9e258dc8
• ssdeep: 1536:qGFYrx7+H8j+bm+RsZYSe7xN8hcdOWlejW0fm71ANJTc:TFYrx7+cjhBZde7ku/eu7/
• TLSH: T13234AFF3109BDD8C7B869B03AAAA50687547C6883132EA9454CD7B7CC97C2FC7E40964
• Submitted as: kadidasililelivugus.pdf
• File type: pdf · Size: 55624 bytes
• Verdict: suspicious (44/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=gunship+battle+mega+mod+apk+revdl, http://files.stealthentertainment.net/uploads/1/3/0/9/130969440/2091dc2cdd68a09.pdf, http://files.elainaburns.com/uploads/1/3/1/3/131384547/nodizubud.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/strik?keyword=gunship+battle+mega+mod+apk+revdl
• http://files.stealthentertainment.net/uploads/1/3/0/9/130969440/2091dc2cdd68a09.pdf
• http://files.elainaburns.com/uploads/1/3/1/3/131384547/nodizubud.pdf
• http://files.lewandbuilding.com/uploads/1/3/1/8/131872298/bepadufo_lekukixenedep_zatoruve_liwitarolenori.pdf
• http://files.ccbkindergarten.com/uploads/1/3/1/8/131859527/8482111.pdf
• https://cdn.shopify.com/s/files/1/0432/1378/3199/files/12594882244.pdf
• http://jibivos.carpetcleaningstpete.com/uploads/1/3/0/7/130738948/zikuvunowimabafasor.pdf
• http://jupawuveg.thoughtstoyou.com/uploads/1/3/1/8/131856584/vitizu-moverovaxonozu-supejefuge-rijademidevusu.pdf
• http://files.findanazhome.com/uploads/1/3/0/7/130776200/jofivomidujut.pdf
• http://zawabane.semitourist.com/uploads/1/3/0/7/130776219/8567130.pdf
• http://gojade.riverrockinc1.com/uploads/1/3/1/4/131438847/fesegekolubiwu.pdf
• http://xexozavu.immanuellutheranchurch.org/uploads/1/3/0/7/130776885/87dc61a8fb039.pdf
• http://files.normanstreet.co.uk/uploads/1/3/1/6/131637656/pirisuwowapumabij.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• files.stealthentertainment.net
• files.elainaburns.com
• files.lewandbuilding.com
• files.ccbkindergarten.com
• cdn.shopify.com
• jibivos.carpetcleaningstpete.com
• jupawuveg.thoughtstoyou.com
• files.findanazhome.com
• zawabane.semitourist.com
• gojade.riverrockinc1.com
• xexozavu.immanuellutheranchurch.org
• files.normanstreet.co.uk
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report