SUSPICIOUS — mukilalesoliva.pdf

SUSPICIOUS — mukilalesoliva.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: a96566332f0a0f174d7581f7a9bb69d0841dfb21dff83614a31cade788ceef98
• SHA-1: fe17a988591a4ee3507a64b44712bfbf07b3a7b6
• MD5: a545d8cd0ac7d5bc0f7e62e8faadb70d
• ssdeep: 768:KgGzpDn9s3nk6GD8CvjvPjV4NYgzodvtU7Q:XGFbS4D8kfVVXtU7Q
• TLSH: T1C22F8EF3919BED8C7AC7AB135DAA2459204AC748A032A5B418DC777C847C6FDAE10860
• Submitted as: mukilalesoliva.pdf
• File type: pdf · Size: 34150 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/wb?keyword=weathering%20and%20erosion%20worksheets%20for%202nd%20grade, https://kolerekum.weebly.com/uploads/1/3/4/3/134350376/2212716.pdf, https://gukaguse.weebly.com/uploads/1/3/1/3/131398473/4193020.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/wb?keyword=weathering%20and%20erosion%20worksheets%20for%202nd%20grade
• https://kolerekum.weebly.com/uploads/1/3/4/3/134350376/2212716.pdf
• https://gukaguse.weebly.com/uploads/1/3/1/3/131398473/4193020.pdf
• https://zozufawagizawag.weebly.com/uploads/1/3/4/4/134454621/44843ecf.pdf
• https://sifumoxijobobo.weebly.com/uploads/1/3/4/4/134493963/5755144.pdf
• https://jubamojeke.weebly.com/uploads/1/3/4/4/134432472/2718646.pdf
• https://xilorufanil.weebly.com/uploads/1/3/0/7/130739938/xifizus.pdf
• https://latijivetazemor.weebly.com/uploads/1/3/0/7/130775002/2007834.pdf
• https://dosedupuwosiwoz.weebly.com/uploads/1/3/0/7/130776272/dopasujalatiso-givofi-wedutut-botifitamuja.pdf
• https://jurizimobijagi.weebly.com/uploads/1/3/0/8/130874317/380d9f0.pdf
• https://mejodulifewu.weebly.com/uploads/1/3/4/5/134526208/4928133.pdf
• https://gikoberi.weebly.com/uploads/1/3/0/9/130969260/2f631bb2a2f.pdf
• https://mojenosude.weebly.com/uploads/1/3/1/3/131382274/nolukida-wewiwasuf-kebori-dejev.pdf
• https://cdn-cms.f-static.net/uploads/4367640/normal_5f950c39dee77.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• kolerekum.weebly.com
• gukaguse.weebly.com
• zozufawagizawag.weebly.com
• sifumoxijobobo.weebly.com
• jubamojeke.weebly.com
• xilorufanil.weebly.com
• latijivetazemor.weebly.com
• dosedupuwosiwoz.weebly.com
• jurizimobijagi.weebly.com
• mejodulifewu.weebly.com
• gikoberi.weebly.com
• mojenosude.weebly.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report