SUSPICIOUS — nukazos.pdf
SUSPICIOUS — nukazos.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
6ec54890f7970d05e064af760e0b4ea18ca85950b808cb438a69929e7028f5b9 - SHA-1:
b824fed0c8eb3bf2f0867c2c49b7eb62a608f2c2 - MD5:
30bf320b99a57b5e6ed820b1fff4cd2f - ssdeep:
768:9gGzpDQcfbQXvkofyFB4p0fRhP0GtdNqWFZ9F2jCZkScsPX4gk9m:+GFk+0Xvk3FL9Rb2jF+X1k9m - TLSH:
T1CD328DF311A7EC4C7B8A9B176DBB1099A04AD34C61329B6048C8773CC4BC6ED6F14A65 - Submitted as: nukazos.pdf
- File type: pdf · Size: 45534 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=inspirational%20quotes%20for%20youngsters%20tamil%20pdf, https://jimigafekalese.weebly.com/uploads/1/3/1/4/131407537/detegikabivuzesinam.pdf, https://zevodajiwagadiz.weebly.com/uploads/1/3/4/3/134340874/8522249.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=inspirational%20quotes%20for%20youngsters%20tamil%20pdf
- https://jimigafekalese.weebly.com/uploads/1/3/1/4/131407537/detegikabivuzesinam.pdf
- https://zevodajiwagadiz.weebly.com/uploads/1/3/4/3/134340874/8522249.pdf
- https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/movew.pdf
- https://s3.amazonaws.com/zetare/91742692134.pdf
- https://s3.amazonaws.com/magapeguwabe/loan_contract_form.pdf
- https://s3.amazonaws.com/daraniwekamidir/the_super-_afrikaners._inside_the_afrikaner_broederbond.pdf
- https://s3.amazonaws.com/gofilafixu/gua_ceneval_egel_medicina_general.pdf
- https://s3.amazonaws.com/widiku/bailey_and_love_surgery_27th_edition_download.pdf
- https://s3.amazonaws.com/davubewu/pepovamozu.pdf
- https://s3.amazonaws.com/lomogas/islamic_books_in_urdu_free_download_ahle_hadees.pdf
- https://ximazula.weebly.com/uploads/1/3/0/7/130738777/mipagililokiziz-fojuw-goladud-miposi.pdf
- https://xonuveviriniw.weebly.com/uploads/1/3/0/7/130738603/pojatuxononetew_tifizotubuw_puwumat.pdf
- https://senobatupubem.weebly.com/uploads/1/3/1/4/131437889/5426e0baf5.pdf
- https://welofubevi.weebly.com/uploads/1/3/1/8/131856084/xufes.pdf
- https://kelobutino.weebly.com/uploads/1/3/0/9/130969458/fazetegazo_tanemerodujidew_funofibe_sibobajevi.pdf
- https://uploads.strikinglycdn.com/files/5e9e4c95-62be-4059-8d19-ecca9151ee11/tixisadelomojesejurofir.pdf
- https://uploads.strikinglycdn.com/files/e2f203a2-64af-4f2a-9dbd-29fc25c4425d/fafalonowude.pdf
- https://cdn-cms.f-static.net/uploads/4384160/normal_5f8f8e1e1c882.pdf
- https://cdn-cms.f-static.net/uploads/4368222/normal_5f8b2889e98de.pdf
- https://cdn-cms.f-static.net/uploads/4388178/normal_5f91151c90eb3.pdf
- https://cdn-cms.f-static.net/uploads/4382952/normal_5f92b5ab92718.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- gettraff.ru
- jimigafekalese.weebly.com
- zevodajiwagadiz.weebly.com
- jatorogerujew.weebly.com
- s3.amazonaws.com
- ximazula.weebly.com
- xonuveviriniw.weebly.com
- senobatupubem.weebly.com
- welofubevi.weebly.com
- kelobutino.weebly.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report