SUSPICIOUS — karawilirezixagaxizivemu.pdf

SUSPICIOUS — karawilirezixagaxizivemu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: c519d853ddcb552cbdb665c1f5688ea3e29ef51e03d9dd410441fa2e64ddbe4e
• SHA-1: aa4940107f6b96ad28ccbbed5d76cd64108d8566
• MD5: 247cbd554224d94daf5fd51b436c2d14
• ssdeep: 768:0gGzpD6pWDg4meviEKHPcxtr5jnOLv767EzicZphB+K8kL5:BGFmpWDQ/EKHPQtlnyJ3hEK8kL5
• TLSH: T18B33AFF3406BFC9D7B8FAB03ADE6111D5546C28DA236876411887B2CD4B85BCAF44A24
• Submitted as: karawilirezixagaxizivemu.pdf
• File type: pdf · Size: 48086 bytes
• Verdict: suspicious (44/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=functional+constipation+nice+guidelines, http://pututu.vegantuneupcafe.com/uploads/1/3/2/6/132680835/0d249b701d11.pdf, http://files.nancynailsupply.com/uploads/1/3/1/6/131606672/sudujoxububarolap.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=functional+constipation+nice+guidelines
• http://pututu.vegantuneupcafe.com/uploads/1/3/2/6/132680835/0d249b701d11.pdf
• http://files.nancynailsupply.com/uploads/1/3/1/6/131606672/sudujoxububarolap.pdf
• http://lasaweko.nativitiesfromaroundtheworld.com/uploads/1/3/1/3/131380005/gawoborago_nibozawolamuxow_ravezimigeval_totad.pdf
• http://files.monalisamugshots.net/uploads/1/3/0/9/130969897/womukotupopeb.pdf
• http://files.rcnanorthbay.com/uploads/1/3/1/8/131856934/e847e7a442d.pdf
• http://files.andreasignori.com/uploads/1/3/1/8/131857580/61651.pdf
• https://site-1036733.mozfiles.com/files/1036733/2158261166.pdf
• https://site-1036719.mozfiles.com/files/1036719/86030520290.pdf
• https://site-1036753.mozfiles.com/files/1036753/44881539249.pdf
• https://cdn.shopify.com/s/files/1/0483/9548/5352/files/aller_passe_compose.pdf
• https://cdn.shopify.com/s/files/1/0476/9919/8118/files/essent_mortgage_insurance_rate_finder.pdf
• https://cdn.shopify.com/s/files/1/0434/6049/3474/files/radiologist_assistant_salary_ny.pdf
• https://cdn.shopify.com/s/files/1/0469/0558/9920/files/ginurejuxoxulixoz.pdf
• https://cdn.shopify.com/s/files/1/0499/9872/5275/files/turun_sanomat_nkislehti.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• pututu.vegantuneupcafe.com
• files.nancynailsupply.com
• lasaweko.nativitiesfromaroundtheworld.com
• files.monalisamugshots.net
• files.rcnanorthbay.com
• files.andreasignori.com
• site-1036733.mozfiles.com
• site-1036719.mozfiles.com
• site-1036753.mozfiles.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report