MALICIOUS — kuzawopagubikuxefuvefowub.pdf

MALICIOUS — kuzawopagubikuxefuvefowub.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 58b54923e4b6220bfbb8b66aa45978ac04168606ec939467ba53f7d34125d02d
SHA-1: 86c96a0aeaaf51b4e63cb29a13dfe9d4e8522d22
MD5: dc7cb13f03427403345f4a5b6ed61444
ssdeep: 1536:5GFYe94deu4T27eJ+ojPWoK+cMFLuSrXVlP3EUy:MFYbeuZikojRFcMFLjXjO
TLSH: T14434AEF3409BDC4D3B826B43A8F6216A604AC7887233AA64159CBB7CD57C5FCBD00951
Submitted as: kuzawopagubikuxefuvefowub.pdf
File type: pdf · Size: 56172 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ggtraff.ru/strik?keyword=konsep+agama+dalam+islam+pdf, http://lopiw.holdenstudios808.com/uploads/1/3/1/1/131163653/8761318.pdf, http://kavosomi.rimrockeffects.com/uploads/1/3/1/0/131070171/b7824029eda6b85.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

1129 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

root_.cache_dconf_user - 96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7

Embedded URLs

https://ggtraff.ru/strik?keyword=konsep+agama+dalam+islam+pdf
http://lopiw.holdenstudios808.com/uploads/1/3/1/1/131163653/8761318.pdf
http://kavosomi.rimrockeffects.com/uploads/1/3/1/0/131070171/b7824029eda6b85.pdf
http://files.angelatipsey.com/uploads/1/3/0/8/130874671/nilanogebadawe.pdf
https://cdn.shopify.com/s/files/1/0428/9835/8432/files/57355052908.pdf
https://cdn.shopify.com/s/files/1/0437/3407/3505/files/jebogowemugumosit.pdf
https://cdn.shopify.com/s/files/1/0482/7742/2235/files/psychology_multiple_choice_questions_and_answers.pdf
https://cdn.shopify.com/s/files/1/0429/7592/0282/files/mavawubu.pdf
https://cdn.shopify.com/s/files/1/0439/2324/3176/files/68767119707.pdf
https://cdn.shopify.com/s/files/1/0431/2937/2832/files/56933465685.pdf
https://cdn.shopify.com/s/files/1/0434/5266/1912/files/67447454326.pdf
https://cdn.shopify.com/s/files/1/0481/9943/4394/files/chapter_12_solutions_accounting.pdf
https://cdn.shopify.com/s/files/1/0433/1657/6424/files/78970563481.pdf
https://cdn.shopify.com/s/files/1/0428/8672/5795/files/kuwopunopamag.pdf
https://cdn.shopify.com/s/files/1/0427/8353/9366/files/lewojepidozimobegut.pdf
https://cdn.shopify.com/s/files/1/0434/1579/7917/files/wild_animals_information_in_english.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ggtraff.ru
lopiw.holdenstudios808.com
kavosomi.rimrockeffects.com
files.angelatipsey.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report