MALICIOUS — lunadaxefo.pdf

MALICIOUS — lunadaxefo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 68ba6e530a841d05d6202c08c0c312ed25f489fa888a9fdd13d672ddc35e5725
• SHA-1: eb9482cc98d9c9ae3071f9c3778d33861cad5024
• MD5: 0e9c654b8d251e544e3fed8e86efbec1
• ssdeep: 768:YgGzpDJ7hW9pzUa5pZPFtstHqCG3SMZ2iNEuCjBgMgnIe9xakYwbLcc+h:1GFV74nDFtKKC2ZJNAjLEIeaIPcc+h
• TLSH: T182319EF71197DE8C7A85AB07A9A2146A604EC2CC203397B046D97B7DC0BC2BC7E50931
• Submitted as: lunadaxefo.pdf
• File type: pdf · Size: 40997 bytes
• Verdict: malicious (70/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://ggtraff.ru/wb?keyword=convert%20pdf%20to%20excel%20free%20online%20converter%20without%20email, https://cdn-cms.f-static.net/uploads/4367005/normal_5f876511c520b.pdf, https://uploads.strikinglycdn.com/files/7b3934c8-2d26-4da0-93d5-8ce9ae7c9051/mackie_sr24._4_vlz_pro.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/wb?keyword=convert%20pdf%20to%20excel%20free%20online%20converter%20without%20email
• https://cdn-cms.f-static.net/uploads/4367005/normal_5f876511c520b.pdf
• https://uploads.strikinglycdn.com/files/7b3934c8-2d26-4da0-93d5-8ce9ae7c9051/mackie_sr24._4_vlz_pro.pdf
• https://cdn.shopify.com/s/files/1/0268/8896/2219/files/deziroluporejumeluvegon.pdf
• https://cdn.shopify.com/s/files/1/0435/8812/4830/files/the_sims_free_play_guide.pdf
• https://cdn-cms.f-static.net/uploads/4365586/normal_5f9535384143b.pdf
• https://nulivoji.weebly.com/uploads/1/3/4/3/134343303/zepugivalo_soxenufoxoni_fosujedobim_gakogixiru.pdf
• https://uploads.strikinglycdn.com/files/49357316-4043-486b-9af3-a859cd72e656/97454716358.pdf
• https://cdn-cms.f-static.net/uploads/4407777/normal_5f94d58ede35a.pdf
• https://uploads.strikinglycdn.com/files/3a92f019-fb37-4239-8bb1-9b1915675f19/12816461223.pdf
• https://uploads.strikinglycdn.com/files/0350fb45-01ca-4777-b5c4-1e8fd4458163/vuzumugifem.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• cdn-cms.f-static.net
• uploads.strikinglycdn.com
• cdn.shopify.com
• nulivoji.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report