SUSPICIOUS — xitisofutorafebun.pdf
SUSPICIOUS — xitisofutorafebun.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c7386c221251e85a9fd9b722eba89b09b0326888205d815b90113b2c9f6b6c17 - SHA-1:
f79ec48756d7655de60166e18d4b2c6475d0afa2 - MD5:
709e13be63865b01d37eecc3abdb2a48 - ssdeep:
768:pgGzpDvpe6Q0FnXmXJiRYE6TRL6cG/XoZj8cj/Iv//06m3cWB0vHR6Od354:KGFjpFRWo6MEQY/u//QcWSAOdp4 - TLSH:
T135327CF311A7ED8C79C6AB03AEEB245D9049D3496132D7A44598772DC47CBBD3E20A20 - Submitted as: xitisofutorafebun.pdf
- File type: pdf · Size: 44451 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://pevugubak.weebly.com/uploads/1/3/2/7/132740457/cfa6e37f0d0.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=intro%20to%20differential%20equations%20boyce, https://wujibinofowe.weebly.com/uploads/1/3/1/3/131383737/jivobopiwileva_bawivad.pdf, https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/winepogor.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=intro%20to%20differential%20equations%20boyce
- https://wujibinofowe.weebly.com/uploads/1/3/1/3/131383737/jivobopiwileva_bawivad.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/winepogor.pdf
- https://pevugubak.weebly.com/uploads/1/3/2/7/132740457/cfa6e37f0d0.pdf
- https://site-1037922.mozfiles.com/files/1037922/94949924573.pdf
- https://site-1043456.mozfiles.com/files/1043456/sadorivinedopepulage.pdf
- https://site-1048559.mozfiles.com/files/1048559/77136402616.pdf
- https://site-1044518.mozfiles.com/files/1044518/faxinutokuwozedasi.pdf
- https://uploads.strikinglycdn.com/files/80a2a3bb-2bed-4d87-9e6f-f8cbd32c7e02/mijarojuzetovoniduto.pdf
- https://uploads.strikinglycdn.com/files/234d9e76-6921-4d08-a99f-a42caf42cd64/bikomupomab.pdf
- https://uploads.strikinglycdn.com/files/a5b21599-6c21-4c3f-980b-1b335bb25ca6/62726607230.pdf
- https://uploads.strikinglycdn.com/files/f108485d-a020-476e-b52c-6e6256a517b8/witugonerixulotifidekezo.pdf
- https://cdn.shopify.com/s/files/1/0481/7590/6973/files/tai_zalo_apk_2020.pdf
- https://cdn.shopify.com/s/files/1/0428/7479/8247/files/drift_cars_for_sale.pdf
- https://cdn.shopify.com/s/files/1/0431/3638/5181/files/100_civics_questions_and_answers_with_mp3_audio_spanish_version.pdf
- https://cdn.shopify.com/s/files/1/0457/6336/2980/files/hadoop_capacity_planning_calculator.pdf
- https://cdn.shopify.com/s/files/1/0431/2737/3981/files/goriwopepovigumemisunaja.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/f9007.pdf
- https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/3722212.pdf
- https://wovasemuzusalej.weebly.com/uploads/1/3/1/6/131636629/watamavebon.pdf
- https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/xopevu_vilugarokobijos_fimorekon.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- cctraff.ru
- wujibinofowe.weebly.com
- zoxuzuxebexot.weebly.com
- pevugubak.weebly.com
- site-1037922.mozfiles.com
- site-1043456.mozfiles.com
- site-1048559.mozfiles.com
- site-1044518.mozfiles.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- dutitujazekap.weebly.com
- jawasolasazilem.weebly.com
- wovasemuzusalej.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report