SUSPICIOUS — sapux_tikurototetunep.pdf

SUSPICIOUS — sapux_tikurototetunep.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: a85f46d05c51b214f8b62f44412e91ceac3c5124836179e733874744904d4517
• SHA-1: 2389c6a3338e9b410c759c711c7a872923c2fc80
• MD5: 923ce76c664bbd3b4faf8dc91646bc29
• ssdeep: 768:9gGzpDqBhYVMP2t8+7SU/jfqxZxCvxwpaORCq6lrWeR39gwwaAxQKSj5X:+GF+DSSU/jfu3CvxwpaOX6aeR7waZhj9
• TLSH: T1C431A0F36057DD8C76836B136EB6042A214AD78C7133A2A4598D7BACC4BC5AC3F61970
• Submitted as: sapux_tikurototetunep.pdf
• File type: pdf · Size: 41897 bytes
• Verdict: suspicious (44/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/wb?keyword=tutuapp%20apk%20ios%20free%20download, https://bavejojonosepes.weebly.com/uploads/1/3/1/3/131380601/xifarobupe-befaguxokob-mezevife-finokepuj.pdf, https://uploads.strikinglycdn.com/files/5be8d05e-9923-4136-91c2-5d8ec8105ccd/desepateridativo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/wb?keyword=tutuapp%20apk%20ios%20free%20download
• https://bavejojonosepes.weebly.com/uploads/1/3/1/3/131380601/xifarobupe-befaguxokob-mezevife-finokepuj.pdf
• https://uploads.strikinglycdn.com/files/5be8d05e-9923-4136-91c2-5d8ec8105ccd/desepateridativo.pdf
• https://cdn.shopify.com/s/files/1/0492/2939/8182/files/thus_spoke_zarathustra_download.pdf
• https://s3.amazonaws.com/fujadabez/dedufexifujaxafaxatosuno.pdf
• https://xojerajap.weebly.com/uploads/1/3/1/3/131384359/1441493.pdf
• https://cdn.shopify.com/s/files/1/0481/7715/2151/files/life_after_mod_apk_rexdl.pdf
• https://cdn.shopify.com/s/files/1/0433/5747/0872/files/best_games_without_internet_android.pdf
• https://s3.amazonaws.com/pivetuzadujo/hunewearl_replica_outfit.pdf
• https://cdn.shopify.com/s/files/1/0435/9883/9970/files/narebaxasabakudazepuvide.pdf
• https://cdn.shopify.com/s/files/1/0493/0070/1343/files/hotspot_shield_android_2.3.pdf
• https://firerokuk.weebly.com/uploads/1/3/1/1/131164187/kepenu-likilaxi-wanerojitofetaw.pdf
• https://s3.amazonaws.com/pazifetanegapu/broward_county_schools_calendar.pdf
• https://s3.amazonaws.com/xamibudasagas/understanding_and_using_english_grammar_4rd_edition_answer_key.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• bavejojonosepes.weebly.com
• uploads.strikinglycdn.com
• cdn.shopify.com
• s3.amazonaws.com
• xojerajap.weebly.com
• firerokuk.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report