MALICIOUS — dekovumake.pdf
MALICIOUS — dekovumake.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
a1c6aac16402d12f5f9ef27447b06d5e569774f8e3ebb4e17897d8c9e8d0accf - SHA-1:
ca37b4c0c894fde3c8415c42efee93d8e46a0ca3 - MD5:
1a845ae588eea979c09e8814b5ed2ea9 - ssdeep:
1536:LGFtUwCL4BkPebpKEIq5VDgsDjUs94c3MzUt69ZmBE:qFtUDL4BkO0G5VDXT4c3MzU49Zf - TLSH:
T13537E0F34067ED9D36CBEB47AAAA04559486C38C3532ABB044C97B3DC4B87BC4E59850 - Submitted as: dekovumake.pdf
- File type: pdf · Size: 70315 bytes
- Verdict: malicious (88/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://cctraff.ru/strik?keyword=automotive+lighting+technology+pdf, https://uploads.strikinglycdn.com/files/65a7c8cb-8419-460c-a66a-9f88634d38d6/suzuzifez.pdf, https://uploads.strikinglycdn.com/files/71145cf8-e1f4-417b-8d28-8acc8bf3ef91/4457019313.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/strik?keyword=automotive+lighting+technology+pdf
- https://uploads.strikinglycdn.com/files/65a7c8cb-8419-460c-a66a-9f88634d38d6/suzuzifez.pdf
- https://uploads.strikinglycdn.com/files/71145cf8-e1f4-417b-8d28-8acc8bf3ef91/4457019313.pdf
- https://uploads.strikinglycdn.com/files/e3bce2d1-b18e-4e10-b95c-7b27a2bf0f17/gineduruxafizaxiwepudo.pdf
- https://uploads.strikinglycdn.com/files/4ec2b564-5599-440c-a5ca-682e8417b400/votagegemure.pdf
- https://uploads.strikinglycdn.com/files/8176aaeb-8bc1-4e92-a5b7-0551690c4bea/41914494674.pdf
- http://jovako.myoptique2020.com/uploads/1/3/2/8/132814930/gegolabobofu.pdf
- http://lopiwo.danaeirismcqueen.com/uploads/1/3/0/7/130738796/1242997.pdf
- http://files.vippartytokyo.com/uploads/1/3/1/4/131453302/wulaxemabuwebufomini.pdf
- http://dudimoduf.sheercrystalbellydance.com/uploads/1/3/1/4/131410399/xonuzem_kajas.pdf
- http://piser.doitallpressionals.com/uploads/1/3/1/3/131382486/bupewevikizala_filusivazoveg_vanajizezi_texabad.pdf
- http://files.faithfullyrestoredwomen.com/uploads/1/3/1/8/131856827/lowexosozofovonosixi.pdf
- http://files.kbxsport.com/uploads/1/3/2/7/132710601/c13b01814.pdf
- https://site-1036834.mozfiles.com/files/1036834/55751507923.pdf
- https://site-1037145.mozfiles.com/files/1037145/xifuritutoxuxebobipigos.pdf
- https://site-1036871.mozfiles.com/files/1036871/55173939659.pdf
- https://site-1037035.mozfiles.com/files/1037035/joxib.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- jovako.myoptique2020.com
- lopiwo.danaeirismcqueen.com
- files.vippartytokyo.com
- dudimoduf.sheercrystalbellydance.com
- piser.doitallpressionals.com
- files.faithfullyrestoredwomen.com
- files.kbxsport.com
- site-1036834.mozfiles.com
- site-1037145.mozfiles.com
- site-1036871.mozfiles.com
- site-1037035.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report