SUSPICIOUS — regutuxupujupaposujibabu.pdf

SUSPICIOUS — regutuxupujupaposujibabu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.

Identification

SHA-256: b489518f434d486c4cabf765fb1f75bf1ece77135af2d12bc43d04846c764bbd
SHA-1: 1d62ea22e3931b1b69514abac1f633c241cdf168
MD5: 54e90c236fcfca92714c71d94e83f006
ssdeep: 768:sgGzpDqwjHpmBHxrpXJGoIklJ7eWD+Z8Wzpebrrdt+motIx6Z5FDs:pGFjjJhon7dxWzQDPoIx6Z59s
TLSH: T11B329EF344A3FC4C6B9F6B935DAA01596196C2886622D76044CC7BBCD46C3BCAF10D91
Submitted as: regutuxupujupaposujibabu.pdf
File type: pdf · Size: 47241 bytes
Verdict: suspicious (44/100)

Detections (3 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

Embedded network infrastructure: https://ggtraff.ru/strik?keyword=%25D1%2581%25D1%2582%25D0%25B0%25D1%2582%25D0%25B8%25D1%2581%25D1%2582%25D0%25B8%25D0%25BA%25D0%25B0+13+%25D1%2581%25D0%25BA%25D0%25B0%25D1%2587%25D0%25B0%25D1%2582%25D1%258C+%25D1%2582%25D0%25BE%25D1%2580%25D1%2580%25D0%25B5%25D0%25BD%25D1%2582, http://files.liquidsunshinedesigns.net/uploads/1/3/0/7/130740292/renunuge.pdf, http://zosije.unitestudents.org/uploads/1/3/2/7/132741064/vinenilejo.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ggtraff.ru/strik?keyword=%25D1%2581%25D1%2582%25D0%25B0%25D1%2582%25D0%25B8%25D1%2581%25D1%2582%25D0%25B8%25D0%25BA%25D0%25B0+13+%25D1%2581%25D0%25BA%25D0%25B0%25D1%2587%25D0%25B0%25D1%2582%25D1%258C+%25D1%2582%25D0%25BE%25D1%2580%25D1%2580%25D0%25B5%25D0%25BD%25D1%2582
http://files.liquidsunshinedesigns.net/uploads/1/3/0/7/130740292/renunuge.pdf
http://zosije.unitestudents.org/uploads/1/3/2/7/132741064/vinenilejo.pdf
http://jufokekov.gracievjewelrydesign.com/uploads/1/3/2/7/132740353/koraloxoruni-tixosisutuxizim-kafopux.pdf
https://cdn.shopify.com/s/files/1/0437/9662/7618/files/clash_of_lights_apk_s2.pdf
https://cdn.shopify.com/s/files/1/0437/3970/9589/files/memipiv.pdf
https://cdn.shopify.com/s/files/1/0432/6277/1366/files/98088052258.pdf
https://cdn.shopify.com/s/files/1/0483/1310/6596/files/12753588011.pdf
https://cdn.shopify.com/s/files/1/0430/4525/7367/files/xofof.pdf
http://josotisi.picturescenephotography.com/uploads/1/3/1/3/131398589/delanizakusofur.pdf
http://gozip.treetrimmingpros.net/uploads/1/3/0/8/130874391/zulakozemoj.pdf
http://files.teamchampionsusa.net/uploads/1/3/0/8/130874253/6937969.pdf
http://files.cresswindpickleball.com/uploads/1/3/0/7/130776406/wenuzadi.pdf
http://pugejolep.quantumology.org/uploads/1/3/1/4/131453175/8136999.pdf
http://rasup.wisconsinwaterlaw.com/uploads/1/3/1/4/131409236/lijugamukuluduwaw.pdf
http://soseniwe.lifetimeepoxyfloors.com/uploads/1/3/0/7/130776321/0fb88f3881.pdf
http://files.shannoncangey.com/uploads/1/3/2/6/132681772/muteworizil.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ggtraff.ru
files.liquidsunshinedesigns.net
zosije.unitestudents.org
jufokekov.gracievjewelrydesign.com
cdn.shopify.com
josotisi.picturescenephotography.com
gozip.treetrimmingpros.net
files.teamchampionsusa.net
files.cresswindpickleball.com
pugejolep.quantumology.org
rasup.wisconsinwaterlaw.com
soseniwe.lifetimeepoxyfloors.com
files.shannoncangey.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report