SUSPICIOUS — derikivuvipudexal.pdf

SUSPICIOUS — derikivuvipudexal.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: b8c33e915b2be1badcf3fa074db5777b095056788472aba5f8619ba44d4fa0ae
• SHA-1: 651cb6d3519d1f81dbe5f537f05c950f18837e56
• MD5: b145bac11f67a6f14f7d65c84881da4f
• ssdeep: 768:IgGzpD3LpQV5OP7sz1XJGJiI6x/+Pl7Rxq+lpWjoZqA9Wy:FGFTCh5GJ0Jql7Rxx43qWy
• TLSH: T1E8319EF710A3DE8C3A8AAF475EA6059D9086C78D613396604AC87B7CD07C6FD2F50660
• Submitted as: derikivuvipudexal.pdf
• File type: pdf · Size: 40618 bytes
• Verdict: suspicious (44/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=mini+mental+status+examination+format+pdf, https://cdn.shopify.com/s/files/1/0491/8204/8422/files/samsung_aquajet_top_load_washer_manual.pdf, https://cdn.shopify.com/s/files/1/0487/9355/1013/files/gojuxozigafaw.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/strik?keyword=mini+mental+status+examination+format+pdf
• https://cdn.shopify.com/s/files/1/0491/8204/8422/files/samsung_aquajet_top_load_washer_manual.pdf
• https://cdn.shopify.com/s/files/1/0487/9355/1013/files/gojuxozigafaw.pdf
• https://cdn.shopify.com/s/files/1/0429/3279/7607/files/latin_for_earth.pdf
• https://site-1042191.mozfiles.com/files/1042191/74793129901.pdf
• https://site-1040277.mozfiles.com/files/1040277/mikeviwijezesirev.pdf
• https://site-1039328.mozfiles.com/files/1039328/36342638650.pdf
• https://site-1040358.mozfiles.com/files/1040358/87533070467.pdf
• http://kokux.maureenennsstudioltd.com/uploads/1/3/0/9/130969177/99dd06dbb760.pdf
• http://files.myleafandcompany.com/uploads/1/3/0/8/130814286/3851c.pdf
• http://files.adoxresearch.com/uploads/1/3/1/3/131384121/8333168.pdf
• http://wigevos.robynshaw.net/uploads/1/3/1/6/131607163/7750338.pdf
• http://xizami.rscareersupport.org/uploads/1/3/1/4/131452836/gipupaledaniwa.pdf
• http://files.pfcmooremess.com/uploads/1/3/0/7/130776072/65264bc54.pdf
• http://files.larrclub.org/uploads/1/3/1/3/131398100/203ed1d3251.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• cdn.shopify.com
• site-1042191.mozfiles.com
• site-1040277.mozfiles.com
• site-1039328.mozfiles.com
• site-1040358.mozfiles.com
• kokux.maureenennsstudioltd.com
• files.myleafandcompany.com
• files.adoxresearch.com
• wigevos.robynshaw.net
• xizami.rscareersupport.org
• files.pfcmooremess.com
• files.larrclub.org
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report