MALICIOUS — rukijika.pdf

MALICIOUS — rukijika.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

SHA-256: 9a28f414f4d8442b0a049e915fcaf6608a0b1f8773ef476673e8d48a53fe3f95
SHA-1: 766c32c8dccaf7c333612c05f644a72939b9db8e
MD5: 63fb25673e29f3928e8298fe65e30158
ssdeep: 768:/ogGzpDBZxe5jDGY/e9470BwQCJJhyQOybe8EgJ6ohc9:/lGFdZYW9TiJhyQ5K8EgEohc9
TLSH: T1CC31ADF340E7ED8C7A8A6B036EFB155A5049E7CD603287A0499C3A6DC47C6BC7E10961
Submitted as: rukijika.pdf
File type: pdf · Size: 42748 bytes
Verdict: malicious (88/100)

Detections (3 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gettraff.ru/strik?keyword=circulatory+system+coloring+worksheet+pdf, https://cdn.shopify.com/s/files/1/0431/4959/0690/files/perl_ilha_alaska_terra_para_venda.pdf, https://cdn.shopify.com/s/files/1/0439/0741/6219/files/essay_for_ielts_general_with_answers.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://gettraff.ru/strik?keyword=circulatory+system+coloring+worksheet+pdf
https://cdn.shopify.com/s/files/1/0431/4959/0690/files/perl_ilha_alaska_terra_para_venda.pdf
https://cdn.shopify.com/s/files/1/0439/0741/6219/files/essay_for_ielts_general_with_answers.pdf
https://cdn.shopify.com/s/files/1/0430/8451/3444/files/41275497383.pdf
https://uploads.strikinglycdn.com/files/acaf77f9-d851-4750-8a39-669ac2938b4d/63684555946.pdf
https://uploads.strikinglycdn.com/files/64941880-e7d2-40a0-ae8a-2c976af0243b/99027635973.pdf
https://uploads.strikinglycdn.com/files/4a6f7bc0-2f3e-45ae-a73d-444d34a3d9fa/73281212505.pdf
https://uploads.strikinglycdn.com/files/7f81fc38-2e9f-44bb-94f5-ee32baf78897/mijiduzimatezuni.pdf
http://files.stainlesssteelfabricators.net/uploads/1/3/0/9/130969923/8862751.pdf
http://mawafa.richlandareafarmersmarket.org/uploads/1/3/1/4/131437299/jikexiwesujixus_nazat_nuneda.pdf
http://files.czarproduction.com/uploads/1/3/1/4/131453850/rubesivepekapiw-jizudapap.pdf
http://sidisova.ministryinmedicine.com/uploads/1/3/1/6/131606165/7496836.pdf
http://files.animspree.com/uploads/1/3/1/6/131606174/nafajiwisafapa_fofifalozodinu.pdf
https://site-1036655.mozfiles.com/files/1036655/43801791846.pdf
https://site-1037893.mozfiles.com/files/1037893/81286623678.pdf
https://site-1036728.mozfiles.com/files/1036728/74919513947.pdf
https://site-1036651.mozfiles.com/files/1036651/pukem.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

gettraff.ru
cdn.shopify.com
uploads.strikinglycdn.com
files.stainlesssteelfabricators.net
mawafa.richlandareafarmersmarket.org
files.czarproduction.com
sidisova.ministryinmedicine.com
files.animspree.com
site-1036655.mozfiles.com
site-1037893.mozfiles.com
site-1036728.mozfiles.com
site-1036651.mozfiles.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report