SUSPICIOUS — tusudukidijinar.pdf
SUSPICIOUS — tusudukidijinar.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
d3761647e8a48573eeaf3d5612648561855488398fa47604645c676d43f80634 - SHA-1:
4335d02c7548fd22a617904b6d40203dd4b91177 - MD5:
0376b5547f27d92f9ccc2ce7300d5fad - ssdeep:
768:ugGzpDACjOYFfa0b/lAOYaTkhBqkstb3DdjMgVS5:LGFk8/8QkhBul3DBMgVS5 - TLSH:
T18E318EF31457ED8C7A8AAB036DA72056618FD38C6136976054D8773CC8BC2BD7E81861 - Submitted as: tusudukidijinar.pdf
- File type: pdf · Size: 40992 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://fiwatinizajof.weebly.com/uploads/1/3/0/8/130874156/6df24c34.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=bushmaster%20ar-15%20assembly%20manual, https://cdn-cms.f-static.net/uploads/4369656/normal_5f949fddde5f7.pdf, https://fiwatinizajof.weebly.com/uploads/1/3/0/8/130874156/6df24c34.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=bushmaster%20ar-15%20assembly%20manual
- https://cdn-cms.f-static.net/uploads/4369656/normal_5f949fddde5f7.pdf
- https://fiwatinizajof.weebly.com/uploads/1/3/0/8/130874156/6df24c34.pdf
- https://cdn.shopify.com/s/files/1/0482/1788/2776/files/dovujilaxitaxofudok.pdf
- https://cdn.shopify.com/s/files/1/0481/5329/7047/files/pifawupa.pdf
- https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/zanadutut_wexudafenatogun_jetomefoja.pdf
- https://tatajojaboxu.weebly.com/uploads/1/3/4/0/134040665/7c6dc8110e331.pdf
- https://buxivadoga.weebly.com/uploads/1/3/0/7/130740323/9497816.pdf
- https://cdn.shopify.com/s/files/1/0437/9282/6517/files/30743254557.pdf
- https://nigupisotaku.weebly.com/uploads/1/3/4/3/134374455/d2d7e50.pdf
- https://cdn.shopify.com/s/files/1/0268/8224/4802/files/5e_giant_coral_snake.pdf
- https://vasedowazapen.weebly.com/uploads/1/3/4/3/134320052/jupobiziguzuwa_gulezur.pdf
- https://jutawalafomas.weebly.com/uploads/1/3/4/3/134316275/9751389.pdf
- https://bubixoduxufito.weebly.com/uploads/1/3/1/0/131070588/8476882.pdf
- https://fuparududewon.weebly.com/uploads/1/3/1/8/131856041/9509331.pdf
- https://penepanixefi.weebly.com/uploads/1/3/4/3/134354239/7121114.pdf
- https://pegebitejujag.weebly.com/uploads/1/3/4/4/134445458/sozevinanadowafaseve.pdf
- https://mefemanodi.weebly.com/uploads/1/3/1/4/131454269/noxaliw-pidiga.pdf
- https://cdn-cms.f-static.net/uploads/4366630/normal_5f8a0b3271a2b.pdf
- https://s3.amazonaws.com/suximawo/cell_theory_worksheet.pdf
- https://cdn-cms.f-static.net/uploads/4375515/normal_5f9253a2ab7c5.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- fiwatinizajof.weebly.com
- cdn.shopify.com
- jakedekokobara.weebly.com
- tatajojaboxu.weebly.com
- buxivadoga.weebly.com
- nigupisotaku.weebly.com
- vasedowazapen.weebly.com
- jutawalafomas.weebly.com
- bubixoduxufito.weebly.com
- fuparududewon.weebly.com
- penepanixefi.weebly.com
- pegebitejujag.weebly.com
- mefemanodi.weebly.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report