MALICIOUS — mupifupobadaxubufino.pdf
MALICIOUS — mupifupobadaxubufino.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
78521acdf0bd7af93aecea6910a33cd5efd08fed4e1bc8e7372d456712cf4586 - SHA-1:
85c95dc8c0f8de39cb7ca06e9a652501178b738e - MD5:
2dd59d12edbb4ce0e8896c7d316a8f28 - ssdeep:
768:DgGzpDFHXGVeYHkUHXqkDkaY9goB7Qi1MMy6rugdyo0MOAHmkmk7XiaH27VXZm:8GFpHWVeYDJDkaoZp1MgdtKAHmepW71s - TLSH:
T1F232AFF310A7DE4C7ACB9F4359B95458A085D388613393A0498DBB2DC5BC6FC6E20B94 - Submitted as: mupifupobadaxubufino.pdf
- File type: pdf · Size: 46815 bytes
- Verdict: malicious (88/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ggtraff.ru/strik?keyword=augusten+burroughs+running+with+scissors+pdf, https://uploads.strikinglycdn.com/files/d7e6d3ce-af5c-48c8-8393-0c84311a5c27/zunipitib.pdf, https://uploads.strikinglycdn.com/files/88cf15da-47d5-4ee2-942a-b39ba1fd8e67/wisaxisitutafovasaluwuw.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/strik?keyword=augusten+burroughs+running+with+scissors+pdf
- https://uploads.strikinglycdn.com/files/d7e6d3ce-af5c-48c8-8393-0c84311a5c27/zunipitib.pdf
- https://uploads.strikinglycdn.com/files/88cf15da-47d5-4ee2-942a-b39ba1fd8e67/wisaxisitutafovasaluwuw.pdf
- https://uploads.strikinglycdn.com/files/30c037d6-eac2-403e-ac05-5652c1628f25/pimeboranemeserexob.pdf
- https://uploads.strikinglycdn.com/files/233b125e-5f32-4b59-b765-56a978b3bf49/nemojutinoxupopere.pdf
- https://uploads.strikinglycdn.com/files/3100470b-f8ff-4b19-b5d6-625c075b4a76/11457636534.pdf
- http://files.whenlifehitz.com/uploads/1/3/1/6/131637679/cf17a8d7.pdf
- http://xolemilil.codyturkeycalls.com/uploads/1/3/0/7/130739640/4b3754102.pdf
- http://files.davidjonesdialogues.com/uploads/1/3/0/8/130874585/429e128d8d683.pdf
- http://nufen.brendadillon.com/uploads/1/3/1/4/131406656/xubog_lavagigumitar.pdf
- http://files.amasamasonlyman.com/uploads/1/3/1/4/131437194/jazigo.pdf
- http://tawakep.sincerelycam.com/uploads/1/3/1/0/131070588/6095922.pdf
- https://uploads.strikinglycdn.com/files/968b1098-d2c1-4467-8dcb-4e3e3ff40bba/fopefutas.pdf
- https://uploads.strikinglycdn.com/files/c143c5d1-933c-4648-a604-b599bb2dfb45/fixosotexopitonote.pdf
- https://uploads.strikinglycdn.com/files/064f12bc-5f3f-490b-8c0b-db8041d891de/96776441359.pdf
- https://uploads.strikinglycdn.com/files/f7487f82-35d1-4070-8ac6-c10e8d5bcb0d/55109080201.pdf
- https://uploads.strikinglycdn.com/files/f85da493-9f22-44a5-b738-42310950e2d3/litador.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- uploads.strikinglycdn.com
- files.whenlifehitz.com
- xolemilil.codyturkeycalls.com
- files.davidjonesdialogues.com
- nufen.brendadillon.com
- files.amasamasonlyman.com
- tawakep.sincerelycam.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report