MALICIOUS — vozedised.pdf

MALICIOUS — vozedised.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 52 detection engines flagged it.

Identification

SHA-256: d2a7acb3e74664f46284bb674b07fcd5f4fda434bfa3b6e9131a6472b6c8d268
SHA-1: 8e06b02bc1e63ade81b4bdc9b9d0e2f3b9134dfe
MD5: a93546690600018684aed046f003e31c
ssdeep: 1536:MGFop4nNa4hfCfRy9LRNt4ZtAN6kwW6ft0O2m0ja2wZOYEQ:pFopuQEfOsXSBd572mkgZOc
TLSH: T19835CFF320D7ED8C7E86EB03AD9A0815658ADB8D65329B6099DC3B2DC07877D6E01C10
Submitted as: vozedised.pdf
File type: pdf · Size: 63061 bytes
Verdict: malicious (88/100)

Detections (3 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gettraff.ru/strik?keyword=training+matrix+template+pdf, https://cdn.shopify.com/s/files/1/0486/1617/7832/files/nespresso_manual_descaling.pdf, https://cdn.shopify.com/s/files/1/0484/3113/6936/files/service_manual_for_briggs_and_stratton_engines.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://gettraff.ru/strik?keyword=training+matrix+template+pdf
https://cdn.shopify.com/s/files/1/0486/1617/7832/files/nespresso_manual_descaling.pdf
https://cdn.shopify.com/s/files/1/0484/3113/6936/files/service_manual_for_briggs_and_stratton_engines.pdf
https://cdn.shopify.com/s/files/1/0496/7038/9924/files/44795792937.pdf
https://site-1037082.mozfiles.com/files/1037082/27491990597.pdf
https://site-1043158.mozfiles.com/files/1043158/napadawuwut.pdf
https://site-1040974.mozfiles.com/files/1040974/36626337726.pdf
https://site-1042824.mozfiles.com/files/1042824/366298521.pdf
https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/rotesojelunemiroto.pdf
https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/movew.pdf
https://xojerajap.weebly.com/uploads/1/3/1/3/131384359/xekena.pdf
https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/kezedivalo-bolumukejufufik.pdf
https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/1cf22.pdf
https://uploads.strikinglycdn.com/files/c8c16b3c-bc04-4cc8-8cbd-9da56a0cd69f/98963093377.pdf
https://uploads.strikinglycdn.com/files/e22be225-5048-4c11-9a60-d57cd43e9116/48154825971.pdf
https://uploads.strikinglycdn.com/files/2257ce2c-19f3-4e54-9fdf-c3723ed558a6/morevoj.pdf
https://uploads.strikinglycdn.com/files/22f41980-d198-4fbc-9d7d-71819d50fce9/sowebajalujuzusokot.pdf
https://uploads.strikinglycdn.com/files/d21e7c43-725a-4adf-bad8-86274b3323ad/wawevomexagugiwulujuk.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

gettraff.ru
cdn.shopify.com
site-1037082.mozfiles.com
site-1043158.mozfiles.com
site-1040974.mozfiles.com
site-1042824.mozfiles.com
vuxozajuje.weebly.com
jatorogerujew.weebly.com
xojerajap.weebly.com
dimaxafazeza.weebly.com
genigudepa.weebly.com
uploads.strikinglycdn.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report