SUSPICIOUS — vumosojuzukos.pdf

SUSPICIOUS — vumosojuzukos.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: c268df5be405ca8c84e6666c551395d3966784d3d7582cfa0c7996c5bff1f9e6
• SHA-1: e66376925b6cf492bef431a40050ca9d5f3c7d31
• MD5: 0602962c14edc636d3828e99fd31b6f6
• ssdeep: 1536:IGF1KkdZRO0y20IXgqjIWrwRl1gyzCw1IPFXEy4t6f5d5Nw5jyxncB:lF1dFcYkgyz5aPFXr4q5ds8w
• TLSH: T19F3AE1F714EBEC9C65DE5F935D9616E9B416C2C86222AB6118C4727CC1787FC2F40620
• Submitted as: vumosojuzukos.pdf
• File type: pdf · Size: 100948 bytes
• Verdict: suspicious (44/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=new+english+file+pre+intermediate+student%2527s+book+workbook+with+answers, http://gagebi.caritas-veveyse.org/uploads/1/3/2/6/132681670/vijen_bofitigigo_kafotobafunumes_semujupazu.pdf, http://fuvani.theforagedfern.com/uploads/1/3/0/7/130739624/8310560.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/strik?keyword=new+english+file+pre+intermediate+student%2527s+book+workbook+with+answers
• http://gagebi.caritas-veveyse.org/uploads/1/3/2/6/132681670/vijen_bofitigigo_kafotobafunumes_semujupazu.pdf
• http://fuvani.theforagedfern.com/uploads/1/3/0/7/130739624/8310560.pdf
• http://fosarez.hanovergrovehoa.com/uploads/1/3/1/1/131163653/xizijisore_bapitefuwe_wivozemu.pdf
• http://files.nayaraduran.com/uploads/1/3/1/3/131380107/1070728.pdf
• http://xasev.ethicsgeneral.com/uploads/1/3/1/4/131410007/19bf4b147417.pdf
• http://files.laurengoodey.com/uploads/1/3/1/3/131398008/furelof_rafenasusexedup.pdf
• http://files.animajewelry.com/uploads/1/3/1/4/131437766/nijasa.pdf
• http://files.justagproductions.com/uploads/1/3/2/8/132814048/ludoduwuz_sivipaleka_magejirozuke_kikabogijolu.pdf
• http://files.focusedlearningsolutions.com/uploads/1/3/1/6/131607331/4429653.pdf
• http://gakisoza.paediatricscienceuk.com/uploads/1/3/0/8/130874210/2327103.pdf
• https://cdn.shopify.com/s/files/1/0459/9424/6301/files/87469168315.pdf
• https://cdn.shopify.com/s/files/1/0431/6630/2359/files/electron_configuration_worksheet_chemistry_if8766.pdf
• https://cdn.shopify.com/s/files/1/0492/4286/5820/files/zulijenirajopipegofu.pdf
• https://cdn.shopify.com/s/files/1/0431/8081/8581/files/xatisilifuvefitemoxakobe.pdf
• https://cdn.shopify.com/s/files/1/0432/0467/3699/files/thom_browne_shirt_sale.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• gagebi.caritas-veveyse.org
• fuvani.theforagedfern.com
• fosarez.hanovergrovehoa.com
• files.nayaraduran.com
• xasev.ethicsgeneral.com
• files.laurengoodey.com
• files.animajewelry.com
• files.justagproductions.com
• files.focusedlearningsolutions.com
• gakisoza.paediatricscienceuk.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report