SUSPICIOUS — wozupuveke.pdf

SUSPICIOUS — wozupuveke.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: adccb53e182c48601eb2dfd259c3a97efad3c1a95244e8ca9c3aaee51725d7c7
• SHA-1: 7f8e47c0d95c62b96eb3df4be285233b50f7aaba
• MD5: a31304da12f54f21dcc8131b8f60fed3
• ssdeep: 768:9gGzpDGphBXpO7XybBBXjBcG1g0aO0b5kweiHaMy37jyGRwPloVIcCg+:+GFqp7XOy9BXjvwwh79JVIcCg+
• TLSH: T12A33AEF35053DD8C3A8A6B47EEB7145A2086D7892136E7A44588BB2CD4BC7FE6F00650
• Submitted as: wozupuveke.pdf
• File type: pdf · Size: 49376 bytes
• Verdict: suspicious (44/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/pify?keyword=austinisd.org+staff+directory, https://cdn.shopify.com/s/files/1/0434/5331/7272/files/download_smule_apk_vip.pdf, https://cdn.shopify.com/s/files/1/0481/7793/8583/files/shinji_get_in_the_robot_lyrics.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/pify?keyword=austinisd.org+staff+directory
• https://cdn.shopify.com/s/files/1/0434/5331/7272/files/download_smule_apk_vip.pdf
• https://cdn.shopify.com/s/files/1/0481/7793/8583/files/shinji_get_in_the_robot_lyrics.pdf
• https://cdn.shopify.com/s/files/1/0481/0303/0947/files/37830698868.pdf
• https://cdn.shopify.com/s/files/1/0427/7056/3239/files/melixuda.pdf
• https://cdn.shopify.com/s/files/1/0481/4694/0065/files/tazodixofigagapif.pdf
• https://cdn.shopify.com/s/files/1/0486/1178/6912/files/94446414090.pdf
• https://cdn.shopify.com/s/files/1/0484/9493/6226/files/sadlier_vocab_workshop_level_f_unit_6_answers.pdf
• https://cdn.shopify.com/s/files/1/0483/6710/8247/files/98789591488.pdf
• http://files.movikedesign.com/uploads/1/3/0/8/130815009/jivufaloxorafi.pdf
• http://files.bbartbyangelica.com/uploads/1/3/0/9/130969986/pezabofedeti.pdf
• http://files.roverdeja.com/uploads/1/3/1/6/131606630/sijatil.pdf
• http://fowuger.mesapack253.org/uploads/1/3/1/8/131856979/bunoniw.pdf
• http://wolosuj.wildharvestbotanicals.ca/uploads/1/3/1/6/131606227/6440840.pdf
• http://files.nysekwang.org/uploads/1/3/1/4/131406060/7577055.pdf
• http://files.newtongrangegala.org/uploads/1/3/0/8/130873715/6446212.pdf
• http://nufezi.thepocketpod.com/uploads/1/3/1/3/131383314/vifijizalufex.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• austinisd.org
• cdn.shopify.com
• files.movikedesign.com
• files.bbartbyangelica.com
• files.roverdeja.com
• fowuger.mesapack253.org
• wolosuj.wildharvestbotanicals.ca
• files.nysekwang.org
• files.newtongrangegala.org
• nufezi.thepocketpod.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report