SUSPICIOUS — fobabufupozuvagilas.pdf

SUSPICIOUS — fobabufupozuvagilas.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: c7ca228700f4901fe79a239458230bd5e76517d0929d5191ad0ed2fcb1c9207b
• SHA-1: 113cfc05503e841daa5f39d9d4887c186fb8df57
• MD5: 250346f3d3fa43ddcbb3389322105ea3
• ssdeep: 768:wgGzpDipt/Gw9EX8eD/xPmiHRAJ+ZXGhTzbpJ7G91aDDj:dGFmpAJTxPnREoG49QDDj
• TLSH: T11431AEF76467ED8C7A4AAB07B9B900981246CB4C7137D2A144D93B3DC5FC2BD6E10A21
• Submitted as: fobabufupozuvagilas.pdf
• File type: pdf · Size: 42569 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=butterfly+valve+operation+manual, https://uploads.strikinglycdn.com/files/99290c02-c6c8-41ce-89d3-35abf2979c91/segodowuruvokixu.pdf, https://uploads.strikinglycdn.com/files/37d894bc-e643-4fab-b3bf-98e5b3f57b96/81539649488.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/strik?keyword=butterfly+valve+operation+manual
• https://uploads.strikinglycdn.com/files/99290c02-c6c8-41ce-89d3-35abf2979c91/segodowuruvokixu.pdf
• https://uploads.strikinglycdn.com/files/37d894bc-e643-4fab-b3bf-98e5b3f57b96/81539649488.pdf
• https://uploads.strikinglycdn.com/files/766c8cf0-fcfe-4cf4-9138-6d02ac71dc0e/39925734526.pdf
• https://uploads.strikinglycdn.com/files/5c267fa2-e739-48d9-93d9-edf44e1a9580/46880545078.pdf
• https://uploads.strikinglycdn.com/files/a6f0fcdc-6d49-4301-a427-9cf25970649a/8553343268.pdf
• https://cdn.shopify.com/s/files/1/0434/7346/9597/files/safety_1st_th041_manual.pdf
• https://cdn.shopify.com/s/files/1/0431/7668/9825/files/vivefoduwokugudibilapup.pdf
• https://cdn.shopify.com/s/files/1/0498/6221/3789/files/the_brand_new_testament_streaming.pdf
• https://uploads.strikinglycdn.com/files/c14c306d-9161-48a1-b4f7-ee4da981f19b/sanopizix.pdf
• https://uploads.strikinglycdn.com/files/8d5bfbd5-0477-497c-bd98-161c5769b808/bewuboxifefunuxabomin.pdf
• https://uploads.strikinglycdn.com/files/1339511e-d5d7-4b40-a664-e9c4febd211f/30579244244.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• uploads.strikinglycdn.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report