SUSPICIOUS — lagegujudadufakagep.pdf
SUSPICIOUS — lagegujudadufakagep.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
c782d7dc1cbd55d8aac493dfc4fc5e7af3ee22e8fe8b200197796147d3a5b37f - SHA-1:
5af173bc17702a443e6ac7bec5c34cda2f84bb7a - MD5:
87bcb39f1500a025c6fb29835cc59b63 - ssdeep:
768:bgGzpD0evQJUEYZJeU2O8aj3DzCyEoH01xDXxSeOdC9dc9aYzRxoYl4ZSS9WzvhH:kGFgeEA0LEtdyE4ZSd9JzJ4/6LVeZo - TLSH:
T1E2338DF350E7DD4C7ACB9F17ADA70068A48AD74DA122979045C8B72CC8BC6BC6F20551 - Submitted as: lagegujudadufakagep.pdf
- File type: pdf · Size: 50379 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/strik?keyword=adobe+premiere+pro+cs6+full+version, https://cdn-cms.f-static.net/uploads/4374682/normal_5f89974189c77.pdf, https://cdn-cms.f-static.net/uploads/4366377/normal_5f874522568cd.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/strik?keyword=adobe+premiere+pro+cs6+full+version
- https://cdn-cms.f-static.net/uploads/4374682/normal_5f89974189c77.pdf
- https://cdn-cms.f-static.net/uploads/4366377/normal_5f874522568cd.pdf
- https://cdn-cms.f-static.net/uploads/4378852/normal_5f8a5e89459fd.pdf
- https://cdn-cms.f-static.net/uploads/4365660/normal_5f875278f0525.pdf
- https://cdn-cms.f-static.net/uploads/4370059/normal_5f8a1375a5309.pdf
- https://cdn-cms.f-static.net/uploads/4365606/normal_5f88ee6d74304.pdf
- https://cdn-cms.f-static.net/uploads/4365635/normal_5f8a1692c1dae.pdf
- https://cdn-cms.f-static.net/uploads/4369638/normal_5f8986e88f7b8.pdf
- https://cdn-cms.f-static.net/uploads/4366042/normal_5f87d4979f5b1.pdf
- https://cdn-cms.f-static.net/uploads/4366359/normal_5f8a6409bc603.pdf
- https://cdn-cms.f-static.net/uploads/4379476/normal_5f8a4be2e51c4.pdf
- https://cdn-cms.f-static.net/uploads/4370317/normal_5f894c023018a.pdf
- https://cdn-cms.f-static.net/uploads/4365606/normal_5f872e30c1632.pdf
- https://cdn-cms.f-static.net/uploads/4370541/normal_5f895028c349e.pdf
- https://cdn-cms.f-static.net/uploads/4366958/normal_5f8a4e7667800.pdf
- https://boguvetasitob.weebly.com/uploads/1/3/1/3/131380850/foxokunejojasek.pdf
- https://zosupexaduj.weebly.com/uploads/1/3/0/7/130738593/jewurepezejoganifem.pdf
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/289df9.pdf
- https://cdn-cms.f-static.net/uploads/4369643/normal_5f891af55b740.pdf
- https://cdn-cms.f-static.net/uploads/4366341/normal_5f89866616eb7.pdf
- https://cdn-cms.f-static.net/uploads/4367310/normal_5f87ae757ec50.pdf
- https://cdn-cms.f-static.net/uploads/4366400/normal_5f871a1370804.pdf
- https://cdn-cms.f-static.net/uploads/4367640/normal_5f8814515a314.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- boguvetasitob.weebly.com
- zosupexaduj.weebly.com
- genigudepa.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report