SUSPICIOUS — gubif.pdf

SUSPICIOUS — gubif.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: d03a796f634652aa850eef910b36a2e72ed00930dd66264ed1b531dede70a3a4
• SHA-1: 582985e2ef7cc67e2f366928c9ca9a69962cf56a
• MD5: 77e4977eace613ef3fe558105ab7f632
• ssdeep: 768:QgGzpDxnsaUDaFd1vqdWtbwRn+jTeIlHHfti:9GFtSWS+/JHfti
• TLSH: T1D82F7DF710A7EC8C6A8FAB03AEBB1498604AD64C6136D76054CD772CC97C6FD2E10961
• Submitted as: gubif.pdf
• File type: pdf · Size: 34850 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=complete+guide+to+home+plumbing+pdf, http://nijumokiz.biesyiczadyfci.com/uploads/1/3/1/1/131164435/tijax_kerados.pdf, http://puguwo.darcyclarke.us/uploads/1/3/2/6/132696056/gofidu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/strik?keyword=complete+guide+to+home+plumbing+pdf
• http://nijumokiz.biesyiczadyfci.com/uploads/1/3/1/1/131164435/tijax_kerados.pdf
• http://puguwo.darcyclarke.us/uploads/1/3/2/6/132696056/gofidu.pdf
• http://files.inclusionandequityresources.com/uploads/1/3/1/0/131070212/5034326.pdf
• http://files.juniatacountytroutclub.com/uploads/1/3/1/4/131406154/rexowamejal.pdf
• https://uploads.strikinglycdn.com/files/1cec1de9-60f6-4375-8caf-e5a81bbc27e4/nutixaxejalimepofazuvidun.pdf
• https://uploads.strikinglycdn.com/files/a2bc4836-0313-4b40-ab1f-581c867ebfe6/19164003841.pdf
• https://uploads.strikinglycdn.com/files/0e0f56c0-d2d5-45c1-8f6f-7018d7b0020b/zikizi.pdf
• https://uploads.strikinglycdn.com/files/4f9d0178-3f5f-42f0-99ab-8432623c9031/86482352807.pdf
• https://uploads.strikinglycdn.com/files/0c916e7e-e6f6-4b78-b63d-cc1d7d7e0078/sifevax.pdf
• https://uploads.strikinglycdn.com/files/4ae0600f-c02f-41d3-978c-1f152d6a1758/jazug.pdf
• https://uploads.strikinglycdn.com/files/e9b6cf79-c86f-46fe-9caa-8c331e23cdc1/10647981910.pdf
• http://files.theroute92.com/uploads/1/3/0/8/130873973/zuguxizamuri.pdf
• http://files.patriciacomb.com/uploads/1/3/1/4/131437983/4830173.pdf
• http://files.bea-cambodia.org/uploads/1/3/1/3/131380024/fesexuguvinogo_fubaruza_potumubopezife_bogekewikafixiw.pdf
• http://files.hawaiistateptsa.org/uploads/1/3/0/8/130874361/karosulevezu_muzob_bineran.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• nijumokiz.biesyiczadyfci.com
• puguwo.darcyclarke.us
• files.inclusionandequityresources.com
• files.juniatacountytroutclub.com
• uploads.strikinglycdn.com
• files.theroute92.com
• files.patriciacomb.com
• files.bea-cambodia.org
• files.hawaiistateptsa.org
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report