MALICIOUS — namesadogodemekinivus.pdf

MALICIOUS — namesadogodemekinivus.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 52 detection engines flagged it.

Identification

• SHA-256: a667a3d315d085884201d4364702d527c30a51795fc85591ebb51c4e336185c8
• SHA-1: ca9e80feab852374e3c32fa594cf3ad7985d03fd
• MD5: 04b98e98d7b40b04a981efce202d18d1
• ssdeep: 768:UgGzpDlgdVNDw7rbKmkZAO7Pycae8LP5boU92vL7S2uYkq4zOWA6oY:hGFpRrOZPjCOjvHS4kBzOV6oY
• TLSH: T11B32BFF7019BED886D8ABB13BEB7105D9106C6CC6136C270069D77ADC0BC9ED6E00A51
• Submitted as: namesadogodemekinivus.pdf
• File type: pdf · Size: 45608 bytes
• Verdict: malicious (78/100)

Detections (2 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=adjective+noun+suffixes+exercises, https://uploads.strikinglycdn.com/files/337c6d2d-b31b-48c8-84cf-b75eca0fc99e/57297755761.pdf, https://uploads.strikinglycdn.com/files/e872185c-fb64-45c7-8373-5a76c5fbcf81/zenazowulozes.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=adjective+noun+suffixes+exercises
• https://uploads.strikinglycdn.com/files/337c6d2d-b31b-48c8-84cf-b75eca0fc99e/57297755761.pdf
• https://uploads.strikinglycdn.com/files/e872185c-fb64-45c7-8373-5a76c5fbcf81/zenazowulozes.pdf
• https://uploads.strikinglycdn.com/files/0493bdfd-34a7-4a45-9340-8cc4d8a187b2/kitidabotuxirob.pdf
• https://uploads.strikinglycdn.com/files/5f902f79-61ab-44c9-9a81-bd5bcf267443/11724411149.pdf
• https://uploads.strikinglycdn.com/files/c3ac44a8-258c-40a4-9426-b9eeef93ba71/filalofe.pdf
• https://uploads.strikinglycdn.com/files/60bbcd52-6ebe-497d-a706-c7caaac9c606/jupupimoralapodov.pdf
• https://uploads.strikinglycdn.com/files/c82df733-2466-4e9e-a9ad-ebb997514b00/88728926493.pdf
• https://uploads.strikinglycdn.com/files/44430752-91c2-4265-8efc-ee707c32bd7c/30752165680.pdf
• https://site-1042883.mozfiles.com/files/1042883/50727792383.pdf
• https://site-1037121.mozfiles.com/files/1037121/vufurutopamisu.pdf
• https://cdn.shopify.com/s/files/1/0427/8288/4006/files/70063908376.pdf
• https://cdn.shopify.com/s/files/1/0434/5957/5958/files/lesson_10.7_practice_b_geometry_answers.pdf
• https://cdn.shopify.com/s/files/1/0478/2581/3663/files/shipley_associates_proposal_guide.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• uploads.strikinglycdn.com
• site-1042883.mozfiles.com
• site-1037121.mozfiles.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report