SUSPICIOUS — sajevikesadesupisaladutu.pdf
SUSPICIOUS — sajevikesadesupisaladutu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
a17ef53ed6400d5371a08d889df323bbad74af52476b7c1151a831d061da1b4a - SHA-1:
99e186f54659bb79fb25c4a5841cd872afece042 - MD5:
2cf848d7df9217144b8fd4a296a69c94 - ssdeep:
768:LgGzpDoRcRuZyl5/GX506psJqZEXEXCSG2/wmv1qvykH6FfETeBWodwEKP:0GFcRcNllixpsJqpFNwEk6JEKWodrKP - TLSH:
T10933AEF31067ED8C6A8B5F03AAEA1058545AE6486037D6B015C87F3CD4BC2FDBE41A61 - Submitted as: sajevikesadesupisaladutu.pdf
- File type: pdf · Size: 48507 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=latin+phrases+pdf, https://site-1043530.mozfiles.com/files/1043530/niwupej.pdf, https://site-1038750.mozfiles.com/files/1038750/fupedumukivet.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/strik?keyword=latin+phrases+pdf
- https://site-1043530.mozfiles.com/files/1043530/niwupej.pdf
- https://site-1038750.mozfiles.com/files/1038750/fupedumukivet.pdf
- https://site-1039188.mozfiles.com/files/1039188/babinobuwabot.pdf
- https://site-1036681.mozfiles.com/files/1036681/17737819785.pdf
- https://cdn.shopify.com/s/files/1/0432/3164/1767/files/the_corporate_culture_survival_guide_schein.pdf
- https://cdn.shopify.com/s/files/1/0435/3464/7451/files/lego_star_wars_the_complete_saga_apk_2020.pdf
- https://cdn.shopify.com/s/files/1/0483/3938/6531/files/mewubosotesawafalosamumi.pdf
- http://zibafop.qdental.ca/uploads/1/3/1/6/131607203/24f00bcfd8def.pdf
- http://tibibabep.silverthrush.com/uploads/1/3/0/8/130874511/71e4b0ccbbeb88.pdf
- http://files.greatmexgrillmesaverde.com/uploads/1/3/2/7/132712383/tijidev.pdf
- http://bapoxuwo.chhs-piratecountry.com/uploads/1/3/1/6/131606201/3950062.pdf
- https://site-1037261.mozfiles.com/files/1037261/8989506560.pdf
- https://site-1036923.mozfiles.com/files/1036923/4538837810.pdf
- https://site-1039351.mozfiles.com/files/1039351/vusini.pdf
- https://site-1037233.mozfiles.com/files/1037233/sidegatitubotikukafumo.pdf
- https://site-1037125.mozfiles.com/files/1037125/givaselalifoviwixumerigej.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- site-1043530.mozfiles.com
- site-1038750.mozfiles.com
- site-1039188.mozfiles.com
- site-1036681.mozfiles.com
- cdn.shopify.com
- zibafop.qdental.ca
- tibibabep.silverthrush.com
- files.greatmexgrillmesaverde.com
- bapoxuwo.chhs-piratecountry.com
- site-1037261.mozfiles.com
- site-1036923.mozfiles.com
- site-1039351.mozfiles.com
- site-1037233.mozfiles.com
- site-1037125.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report