SUSPICIOUS — lubifowupotusanivorato.pdf
SUSPICIOUS — lubifowupotusanivorato.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ca07f9eae6fc8fc3dcc5f5626537c4ecaf182a7591890bfbb6523977f904724b - SHA-1:
7942909ea81e08d6902ef1927b188bf0e7bd2fdf - MD5:
19352a90684eed66d6576001eaecddc2 - ssdeep:
384:NsFlS3K6XgKV7cAgdOpW+0tCHX1HKJPVPJBTYwyYWW5Zq70uHRABMCUSqBm79BRd:RgGzpDuCHXuDtaKML7szR57pGoZ - TLSH:
T1EC307DF35497ED4D2AC7AB136DD615995549C7886133EBA008DC7B2DC4BC2BD7E008A0 - Submitted as: lubifowupotusanivorato.pdf
- File type: pdf · Size: 35859 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: http://files.kitchenpsycho.com/uploads/1/3/0/8/130814479/popojifuxatu_modazo_nananetutufuju_kefopowowunafek.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=casting+defects+handbook+iron+steel+pdf, https://uploads.strikinglycdn.com/files/f14ae3f1-d608-4160-ba3b-28d190119994/93313025027.pdf, https://uploads.strikinglycdn.com/files/d175dd3c-a819-4c31-a3bb-48b6682141c7/foforeferixuxemuwebivugu.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://gettraff.ru/strik?keyword=casting+defects+handbook+iron+steel+pdf
- https://uploads.strikinglycdn.com/files/f14ae3f1-d608-4160-ba3b-28d190119994/93313025027.pdf
- https://uploads.strikinglycdn.com/files/d175dd3c-a819-4c31-a3bb-48b6682141c7/foforeferixuxemuwebivugu.pdf
- https://uploads.strikinglycdn.com/files/da947c45-89e0-435c-b500-69b730e3ec24/88047626621.pdf
- https://uploads.strikinglycdn.com/files/5326c943-90a8-4cdf-85cb-cd11be2e925d/4347019733.pdf
- https://cdn.shopify.com/s/files/1/0477/3930/6140/files/pelopegewurekela.pdf
- https://cdn.shopify.com/s/files/1/0482/0054/8504/files/fugaparuzesowaze.pdf
- https://site-1040871.mozfiles.com/files/1040871/fazuwibexonug.pdf
- https://site-1036874.mozfiles.com/files/1036874/25970029980.pdf
- https://site-1037275.mozfiles.com/files/1037275/bojix.pdf
- https://site-1036848.mozfiles.com/files/1036848/5337001823.pdf
- http://files.kitchenpsycho.com/uploads/1/3/0/8/130814479/popojifuxatu_modazo_nananetutufuju_kefopowowunafek.pdf
- http://kewet.cornellactuarialsociety.com/uploads/1/3/0/9/130969627/rojikavugikilej-xavukoponupi-litix-vipewoduzafomom.pdf
- http://files.torbaycleaningco.com/uploads/1/3/2/6/132682232/rujuravebemugora.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- site-1040871.mozfiles.com
- site-1036874.mozfiles.com
- site-1037275.mozfiles.com
- site-1036848.mozfiles.com
- files.kitchenpsycho.com
- kewet.cornellactuarialsociety.com
- files.torbaycleaningco.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report