SUSPICIOUS — vijiretafinakoxote.pdf

SUSPICIOUS — vijiretafinakoxote.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: a729bdfb5f8b380887ece8ef1a404c14c9f3c3124db631df7b4e1628ba6d7c76
• SHA-1: dbbc669dc590fd1099164395f40e92300988fd72
• MD5: 77b3ae1648af0707269f641b7688370c
• ssdeep: 768:7gGzpDqK6nsZAf9gpge70OiL6AvFmRA7pJq8c02a5EMrrKW:EGFWK6nsZgDuAARAa8c02aWWrKW
• TLSH: T1AF319EF350A7DC0CBEC6DB136AA624686055DB882033A66418E8767CC87C3BD3E61970
• Submitted as: vijiretafinakoxote.pdf
• File type: pdf · Size: 40601 bytes
• Verdict: suspicious (44/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=a+uniform+stick+1.+0+m+long, http://fakiwibor.ewengur.com/uploads/1/3/1/3/131383483/xigip-mapasenepuwawuk-zawokuj.pdf, http://files.koasportscoaching.com/uploads/1/3/2/3/132303238/cca46c7caa405e.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/strik?keyword=a+uniform+stick+1.+0+m+long
• http://fakiwibor.ewengur.com/uploads/1/3/1/3/131383483/xigip-mapasenepuwawuk-zawokuj.pdf
• http://files.koasportscoaching.com/uploads/1/3/2/3/132303238/cca46c7caa405e.pdf
• http://fasone.asldeanpapalia.com/uploads/1/3/1/3/131398539/medogiredi.pdf
• http://files.ccprinceton.org/uploads/1/3/1/3/131383456/1d1a4cac088.pdf
• http://files.earthwiselearningcenter.com/uploads/1/3/0/7/130776035/rufelenuwuzopep_vuzugajaxobe_benijubejimegug_vawop.pdf
• http://files.mgwelch.co.uk/uploads/1/3/2/6/132681307/rulosuxef.pdf
• http://files.jamminforjaclyn.org/uploads/1/3/2/6/132682565/6c5142a95f839.pdf
• https://cdn.shopify.com/s/files/1/0434/5777/3728/files/joint_mathematics_meetings_2020.pdf
• https://cdn.shopify.com/s/files/1/0486/4786/4478/files/bofovuxularekid.pdf
• https://cdn.shopify.com/s/files/1/0428/5621/8780/files/covalent_bond_vs_ionic_bond_examples.pdf
• https://site-1037240.mozfiles.com/files/1037240/sobisukas.pdf
• https://site-1039873.mozfiles.com/files/1039873/negojitotowalanekogarumat.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• fakiwibor.ewengur.com
• files.koasportscoaching.com
• fasone.asldeanpapalia.com
• files.ccprinceton.org
• files.earthwiselearningcenter.com
• files.mgwelch.co.uk
• files.jamminforjaclyn.org
• cdn.shopify.com
• site-1037240.mozfiles.com
• site-1039873.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report