MALICIOUS — vopijimusu.pdf

MALICIOUS — vopijimusu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 9e66138d9b8accaafcd08024d160c0311b49f0e9be513725d6537d21e5631838
• SHA-1: c31b42dfdce8ad2d3d4fe07b7dc01663eeb86e2d
• MD5: 4081eb68c33c7f37cd07a68fdf0c1093
• ssdeep: 768:CgGzpD7/URPto9yeLBaeixsPoY4P9uU8m1s9GaTMwgM4/6/1F:fGFn1DBauf40mS9Ygh/1F
• TLSH: T11532BEF3406AED4D7A86A703ADEA1019A046D78D7533DB68588C763CC4BC57EBE00971
• Submitted as: vopijimusu.pdf
• File type: pdf · Size: 45857 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=projeto+energia+eolica+pdf, http://mefomi.sfghosthunt.com/uploads/1/3/1/8/131856643/fuburatomidapof-polanunasa-tufuzikudowugip-boniw.pdf, http://files.michellemcdanielportfolio.com/uploads/1/3/1/4/131405940/kefejidadi_gekireko_pajelozomija.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=projeto+energia+eolica+pdf
• http://mefomi.sfghosthunt.com/uploads/1/3/1/8/131856643/fuburatomidapof-polanunasa-tufuzikudowugip-boniw.pdf
• http://files.michellemcdanielportfolio.com/uploads/1/3/1/4/131405940/kefejidadi_gekireko_pajelozomija.pdf
• http://files.pbpitch.com/uploads/1/3/2/6/132682076/5915246.pdf
• https://cdn.shopify.com/s/files/1/0431/2625/9876/files/guide_to_network_defense_and_countermeasures.pdf
• https://cdn.shopify.com/s/files/1/0430/9604/7783/files/wujojivupolodixoxirefuwuf.pdf
• https://cdn.shopify.com/s/files/1/0429/6291/1391/files/biwesifutitiw.pdf
• https://cdn.shopify.com/s/files/1/0430/7383/1072/files/biboniv.pdf
• https://site-1036728.mozfiles.com/files/1036728/70785524966.pdf
• https://site-1036716.mozfiles.com/files/1036716/zavil.pdf
• https://site-1037903.mozfiles.com/files/1037903/zunasixaz.pdf
• https://site-1037902.mozfiles.com/files/1037902/gunivigazipe.pdf
• https://site-1036651.mozfiles.com/files/1036651/ninarevi.pdf
• https://uploads.strikinglycdn.com/files/48c9fe8d-08fc-4ae6-83a8-694193a2ecad/wowiligixebafedubezo.pdf
• https://uploads.strikinglycdn.com/files/832e91fc-eba2-4fb4-b28a-30ea248c1600/fomozumaxezunakibadorew.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• mefomi.sfghosthunt.com
• files.michellemcdanielportfolio.com
• files.pbpitch.com
• cdn.shopify.com
• site-1036728.mozfiles.com
• site-1036716.mozfiles.com
• site-1037903.mozfiles.com
• site-1037902.mozfiles.com
• site-1036651.mozfiles.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report