SUSPICIOUS — duwarupizu.pdf
SUSPICIOUS — duwarupizu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
a42d935854da6c49f30339c37dae71a00faf978bc777eb7f92c2711288b8569b - SHA-1:
c32b4608f2ab457ce5c12318b1ca78a0d70cf9fa - MD5:
20375e98cf9f14962e7ea120ed4cb0c9 - ssdeep:
768:4gGzpDxpEiiwBABKHs9q+fPK8uw0mxP5M6FXxUJQ1LZT/kTBdBw1yAt:VGFlpPM9Nfzuw0mxa6IaLZzyJw1yAt - TLSH:
T11A329DF340ABED4C7A8B9B43AEDB21685489838C7133C39455887B6CD4BC6BD7E10960 - Submitted as: duwarupizu.pdf
- File type: pdf · Size: 46750 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=the%20ultimate%20rpg%20character%20backstory%20guide%20free, https://site-1037192.mozfiles.com/files/1037192/jajejip.pdf, https://site-1037911.mozfiles.com/files/1037911/89166447116.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=the%20ultimate%20rpg%20character%20backstory%20guide%20free
- https://site-1037192.mozfiles.com/files/1037192/jajejip.pdf
- https://site-1037911.mozfiles.com/files/1037911/89166447116.pdf
- https://site-1043400.mozfiles.com/files/1043400/95758757621.pdf
- https://site-1036830.mozfiles.com/files/1036830/bujedil.pdf
- https://site-1039888.mozfiles.com/files/1039888/50816173657.pdf
- https://site-1043963.mozfiles.com/files/1043963/nutomirenegikaziwudug.pdf
- https://site-1039342.mozfiles.com/files/1039342/10487164607.pdf
- https://site-1036820.mozfiles.com/files/1036820/57310029089.pdf
- https://site-1036716.mozfiles.com/files/1036716/mupitowo.pdf
- https://site-1036873.mozfiles.com/files/1036873/fuxusegokinomod.pdf
- https://fewevivib.weebly.com/uploads/1/3/0/8/130813821/xabuxeremulaf.pdf
- https://zimiduninu.weebly.com/uploads/1/3/1/6/131637103/2120396.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/jibigamefomoni.pdf
- https://vilukenuxe.weebly.com/uploads/1/3/2/8/132814007/9395878.pdf
- https://rabexowubomisuw.weebly.com/uploads/1/3/1/4/131407155/teduzaxovez-wemojakemoma.pdf
- https://cdn.shopify.com/s/files/1/0433/4374/1083/files/cant_complete_the_book_of_love_skyrim.pdf
- https://cdn.shopify.com/s/files/1/0430/6200/1825/files/norstar_programming_manual.pdf
- https://cdn.shopify.com/s/files/1/0437/1464/2069/files/5349125109.pdf
- https://juragubiv.weebly.com/uploads/1/3/0/8/130874328/a42f6ca.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/5648329.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/8279037.pdf
- https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/zuvekazabuz-topofelo-gupolekodojavo-ponabiloxe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- ggtraff.ru
- site-1037192.mozfiles.com
- site-1037911.mozfiles.com
- site-1043400.mozfiles.com
- site-1036830.mozfiles.com
- site-1039888.mozfiles.com
- site-1043963.mozfiles.com
- site-1039342.mozfiles.com
- site-1036820.mozfiles.com
- site-1036716.mozfiles.com
- site-1036873.mozfiles.com
- fewevivib.weebly.com
- zimiduninu.weebly.com
- fijojonibiw.weebly.com
- vilukenuxe.weebly.com
- rabexowubomisuw.weebly.com
- cdn.shopify.com
- juragubiv.weebly.com
- fodezamu.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report