SUSPICIOUS — ruwupadegexab-ralak-vazazidorolos-fomuxifu.pdf
SUSPICIOUS — ruwupadegexab-ralak-vazazidorolos-fomuxifu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
6eb40b6c1226d36580a250089f37a76381797881d97f9a7278035416096cd719 - SHA-1:
a136e5699ba23ecf90503f6af666a5ae68c2431f - MD5:
c5a005f91275d88c0cbcbc03c39486a2 - ssdeep:
768:qgGzpDvzWhQdblFyYOBKJCsBDazVa3rgiJ5pga4qe:3GFjz3j/BDQMbgSga4R - TLSH:
T1062F7CF3505BEC8C3B8E5F13AEBA1199648AC78D6032976149C87B3CC0BC5ED6E05961 - Submitted as: ruwupadegexab-ralak-vazazidorolos-fomuxifu.pdf
- File type: pdf · Size: 32652 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=csulb%20parking%20map, https://cdn-cms.f-static.net/uploads/4371786/normal_5f90c721caef3.pdf, https://cdn-cms.f-static.net/uploads/4428341/normal_5fa02baacff52.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=csulb%20parking%20map
- https://cdn-cms.f-static.net/uploads/4371786/normal_5f90c721caef3.pdf
- https://cdn-cms.f-static.net/uploads/4428341/normal_5fa02baacff52.pdf
- https://moguvikob.weebly.com/uploads/1/3/0/8/130874292/zutokakowepubuno.pdf
- https://cdn-cms.f-static.net/uploads/4383460/normal_5fa2eabf68e8d.pdf
- https://uploads.strikinglycdn.com/files/bffd0fb7-47c5-4296-82a7-c8a782399ad0/dadanasebe.pdf
- https://cdn-cms.f-static.net/uploads/4406202/normal_5fa76f0d05bc4.pdf
- https://vixijusodu.weebly.com/uploads/1/3/0/7/130776714/8359407.pdf
- https://zigegawemofeza.weebly.com/uploads/1/3/1/4/131406932/7c5e0dfd3381a9.pdf
- https://cdn-cms.f-static.net/uploads/4378149/normal_5fa76ac5cc6cc.pdf
- https://cdn-cms.f-static.net/uploads/4366331/normal_5fa66bc76de72.pdf
- https://silemixijotin.weebly.com/uploads/1/3/4/4/134463531/bonojiso-pemoten.pdf
- https://cdn-cms.f-static.net/uploads/4365639/normal_5f875a0c4108f.pdf
- https://tivakuwisol.weebly.com/uploads/1/3/4/3/134315960/tixewide.pdf
- https://sexozorojupur.weebly.com/uploads/1/3/4/3/134390270/lajelika.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- moguvikob.weebly.com
- uploads.strikinglycdn.com
- vixijusodu.weebly.com
- zigegawemofeza.weebly.com
- silemixijotin.weebly.com
- tivakuwisol.weebly.com
- sexozorojupur.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report