SUSPICIOUS — xatajupuwipa.pdf
SUSPICIOUS — xatajupuwipa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
709155dea1eea7798f0c11b1465683c8ec92c05f61ee04004129379a3a5fec86 - SHA-1:
a92185e792cfb910c859722d1792e38a2f490268 - MD5:
f6d79b9f8049bd75a672b40fed4e2a93 - ssdeep:
768:MgGzpDApYznbYKS3JDyGTrSzc/7GMw+5zQ8BjJlN/c8buWdzfO/UeNDXM5:JGFEpYn2176W5zLZvhRbRhfHwD85 - TLSH:
T1F9329EF31053EC4CB7CAAB07AE9B10A9914DD38D6132979444987B6CD0BCAED7F00661 - Submitted as: xatajupuwipa.pdf
- File type: pdf · Size: 44246 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=asking+for+permission+esl+worksheet, https://site-1048452.mozfiles.com/files/1048452/94326572301.pdf, https://site-1040360.mozfiles.com/files/1040360/fujebubijowejijigagov.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/strik?keyword=asking+for+permission+esl+worksheet
- https://site-1048452.mozfiles.com/files/1048452/94326572301.pdf
- https://site-1040360.mozfiles.com/files/1040360/fujebubijowejijigagov.pdf
- https://site-1042095.mozfiles.com/files/1042095/28121052903.pdf
- https://site-1040313.mozfiles.com/files/1040313/7854600535.pdf
- https://site-1042677.mozfiles.com/files/1042677/20866639621.pdf
- https://site-1042835.mozfiles.com/files/1042835/dibatafasose.pdf
- https://site-1041085.mozfiles.com/files/1041085/zaxiw.pdf
- https://site-1039386.mozfiles.com/files/1039386/mutojazozegozegujasugig.pdf
- https://site-1043475.mozfiles.com/files/1043475/59357909227.pdf
- https://site-1039487.mozfiles.com/files/1039487/7165730453.pdf
- https://site-1043288.mozfiles.com/files/1043288/3949565290.pdf
- https://cdn-cms.f-static.net/uploads/4365660/normal_5f86f4959787c.pdf
- https://cdn-cms.f-static.net/uploads/4365562/normal_5f87055747200.pdf
- https://cdn-cms.f-static.net/uploads/4367281/normal_5f8749d41b20a.pdf
- https://cdn.shopify.com/s/files/1/0484/9519/8363/files/zaxoko.pdf
- https://cdn.shopify.com/s/files/1/0461/8276/0601/files/sioux_center_hockey_schedule.pdf
- https://site-1040663.mozfiles.com/files/1040663/90966125647.pdf
- https://site-1036834.mozfiles.com/files/1036834/4793487848.pdf
- https://site-1039789.mozfiles.com/files/1039789/80733496649.pdf
- https://site-1037237.mozfiles.com/files/1037237/nitarof.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ggtraff.ru
- site-1048452.mozfiles.com
- site-1040360.mozfiles.com
- site-1042095.mozfiles.com
- site-1040313.mozfiles.com
- site-1042677.mozfiles.com
- site-1042835.mozfiles.com
- site-1041085.mozfiles.com
- site-1039386.mozfiles.com
- site-1043475.mozfiles.com
- site-1039487.mozfiles.com
- site-1043288.mozfiles.com
- cdn-cms.f-static.net
- cdn.shopify.com
- site-1040663.mozfiles.com
- site-1036834.mozfiles.com
- site-1039789.mozfiles.com
- site-1037237.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report