SUSPICIOUS — jolul_zeruzosulivob_bazikikizoladu_menepolepon.pdf
SUSPICIOUS — jolul_zeruzosulivob_bazikikizoladu_menepolepon.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
a39a59b1d17ab6a1722f218c6e58517db9415334887dfca04184a56e9049ac7c - SHA-1:
7c39cecc24ad1a2a7a8611ddcfc5a26bfa54e3aa - MD5:
2e50aa9f99649c1c233c39a0ec88d93e - ssdeep:
1536:fGF5p8EeyiaNWB59LgpxjsK4DAzRX2vwyuH7xQeDEvuj8iyDFBcA1vIjr9JoGlae:OF5p8dVaNWB3LuIaRXCnuH7xQAEk8iW4 - TLSH:
T1A03AD0F35053DD8C3B8B7B43BAA701AA6187D78D716697900099732CD478AEC3E90B12 - Submitted as: jolul_zeruzosulivob_bazikikizoladu_menepolepon.pdf
- File type: pdf · Size: 94837 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=hiragana%20books%20pdf, https://vozunutav.weebly.com/uploads/1/3/0/9/130969695/4733702.pdf, https://ninukiwipovesot.weebly.com/uploads/1/3/0/9/130969879/givukubemubibuzize.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=hiragana%20books%20pdf
- https://vozunutav.weebly.com/uploads/1/3/0/9/130969695/4733702.pdf
- https://ninukiwipovesot.weebly.com/uploads/1/3/0/9/130969879/givukubemubibuzize.pdf
- https://mojenosude.weebly.com/uploads/1/3/1/3/131382274/xowugefodizez.pdf
- https://cdn.shopify.com/s/files/1/0484/7255/5674/files/finding_constant_of_proportionality_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0432/2453/1101/files/luduxuxob.pdf
- https://cdn.shopify.com/s/files/1/0481/4851/2921/files/rimamoraduzawel.pdf
- https://cdn.shopify.com/s/files/1/0458/2860/4067/files/back_bay_station_parking_garage.pdf
- https://cdn.shopify.com/s/files/1/0481/3786/3335/files/two_way_frequency_table_worksheet_common_core.pdf
- https://cdn.shopify.com/s/files/1/0429/8699/5863/files/lewunuzavixe.pdf
- https://cdn.shopify.com/s/files/1/0497/2055/7725/files/buxozazifewunitev.pdf
- https://cdn.shopify.com/s/files/1/0484/8304/1430/files/hd_brown_teaching_by_principles.pdf
- https://cdn.shopify.com/s/files/1/0490/0805/0343/files/mario_and_sonic_at_the_olympic_games_2018_release_date.pdf
- https://site-1042822.mozfiles.com/files/1042822/pakaxagabu.pdf
- https://site-1037266.mozfiles.com/files/1037266/44514490286.pdf
- https://site-1042665.mozfiles.com/files/1042665/fonofin.pdf
- https://site-1040096.mozfiles.com/files/1040096/16019547147.pdf
- https://site-1038808.mozfiles.com/files/1038808/bonoroludetopowekubipezo.pdf
- https://site-1038503.mozfiles.com/files/1038503/78222917833.pdf
- https://site-1042787.mozfiles.com/files/1042787/20736662457.pdf
- https://site-1039303.mozfiles.com/files/1039303/judararuzupo.pdf
- https://uploads.strikinglycdn.com/files/db54872a-6240-4dd2-862c-005371a0b5fc/32865575715.pdf
- https://uploads.strikinglycdn.com/files/4343454f-b917-405c-a090-f4f45bb465a7/melafumudasuwejimakob.pdf
- https://uploads.strikinglycdn.com/files/880d72c9-10ca-44bf-9df4-dda409472bff/42552699210.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- vozunutav.weebly.com
- ninukiwipovesot.weebly.com
- mojenosude.weebly.com
- cdn.shopify.com
- site-1042822.mozfiles.com
- site-1037266.mozfiles.com
- site-1042665.mozfiles.com
- site-1040096.mozfiles.com
- site-1038808.mozfiles.com
- site-1038503.mozfiles.com
- site-1042787.mozfiles.com
- site-1039303.mozfiles.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report