SUSPICIOUS — pufisodurug.pdf

SUSPICIOUS — pufisodurug.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: bc2791090d5bb1261034e11da82660b85f5bbdf9ac38d248601e60a846f46642
• SHA-1: eb91f1ce7a1115708bdefbc146bfa7c91072c0ef
• MD5: 2dc3d2f0c165ee8ef653f9938906ca1a
• ssdeep: 768:6gGzpDimFs8LipmTeu86/SWF6XW+7TzwnLfEog1Fa7S0CBepcV:nGFGsskbT8A2GkTyLcog1Y7fCBepy
• TLSH: T16632AFF31097ED8C658F5F079EB710A95446DA8820379B6419C8BB2CD4B87FD2F01A61
• Submitted as: pufisodurug.pdf
• File type: pdf · Size: 45032 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=mrs+pugh+annie, https://site-1036816.mozfiles.com/files/1036816/65422114527.pdf, https://site-1037230.mozfiles.com/files/1037230/52347940491.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/strik?keyword=mrs+pugh+annie
• https://site-1036816.mozfiles.com/files/1036816/65422114527.pdf
• https://site-1037230.mozfiles.com/files/1037230/52347940491.pdf
• https://site-1038792.mozfiles.com/files/1038792/fabupavujasaredukasegu.pdf
• http://files.willspires.com/uploads/1/3/2/3/132303270/ef74e.pdf
• http://files.doodleagility.co.uk/uploads/1/3/0/9/130969360/titasonemituni.pdf
• http://files.kumisillustrations.co.uk/uploads/1/3/2/8/132815367/lebamavuwi.pdf
• http://xojelugar.teamwolverineathletics.com/uploads/1/3/1/3/131380594/b30033468.pdf
• http://bosezupe.purduegcc.com/uploads/1/3/0/7/130740086/4113291.pdf
• http://files.redhawktheaterbc.com/uploads/1/3/0/7/130775623/9429444.pdf
• http://files.cluster7c.com/uploads/1/3/0/7/130738555/d8ce510a52dc7c8.pdf
• http://files.metcalfe4pa.org/uploads/1/3/0/7/130739349/9355617.pdf
• http://wifuxebu.thebuttress.com/uploads/1/3/0/8/130813934/zogete_setoboguweweweb.pdf
• http://korol.texukim.com/uploads/1/3/1/8/131871761/zorogazozerikepotir.pdf
• http://files.olivet.us/uploads/1/3/1/4/131406149/tuzoxefovos_wovonal_sepabozamop.pdf
• http://podamu.vector-business.com/uploads/1/3/1/4/131437822/dasobotebiz.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• site-1036816.mozfiles.com
• site-1037230.mozfiles.com
• site-1038792.mozfiles.com
• files.willspires.com
• files.doodleagility.co.uk
• files.kumisillustrations.co.uk
• xojelugar.teamwolverineathletics.com
• bosezupe.purduegcc.com
• files.redhawktheaterbc.com
• files.cluster7c.com
• files.metcalfe4pa.org
• wifuxebu.thebuttress.com
• korol.texukim.com
• files.olivet.us
• podamu.vector-business.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report