SUSPICIOUS — zegodinivufepar.pdf
SUSPICIOUS — zegodinivufepar.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
e908adee9a7b3a85636bb72017bfc4e96ac29216f5ee867ec4c8707f20caf3c5 - SHA-1:
a7f20cf8e4483d0e4a460b5fd740210aa2e4d231 - MD5:
a3c0c00e8bb17be7a66e0cd0d6631666 - ssdeep:
768:cgGzpDeM5TKoeaRWhHAncrwswYCTYypGRY2I74dYjhZ:5GFi+4Z09YC7QRu4dYjhZ - TLSH:
T1F9318DF360D7DD8C7A869B039DB6116A518BC3887236936098DC763DC47C6FDAE20861 - Submitted as: zegodinivufepar.pdf
- File type: pdf · Size: 39722 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: http://pujug.blackfoxllc.com/uploads/1/3/2/3/132303189/jipigavozibojumomez.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=skoda+fabia+combi+2011+manual, http://pujug.blackfoxllc.com/uploads/1/3/2/3/132303189/jipigavozibojumomez.pdf, http://files.ahleithner.com/uploads/1/3/0/8/130874213/de0d9daa2534.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/strik?keyword=skoda+fabia+combi+2011+manual
- http://pujug.blackfoxllc.com/uploads/1/3/2/3/132303189/jipigavozibojumomez.pdf
- http://files.ahleithner.com/uploads/1/3/0/8/130874213/de0d9daa2534.pdf
- http://files.olofleffler.com/uploads/1/3/1/3/131380440/dusuzijaviziw-zubirumefuxarip.pdf
- http://files.biggleswadesquash.com/uploads/1/3/1/0/131070581/686eb.pdf
- http://files.stevenkbeattie.com/uploads/1/3/0/7/130739935/564461.pdf
- http://files.bcahope.com/uploads/1/3/1/4/131407080/zopafoxin.pdf
- http://files.drumcrimewatch.com/uploads/1/3/0/9/130969950/pudebaxijizol-kufizuxakut.pdf
- http://files.kosative.com/uploads/1/3/1/3/131379014/1883196.pdf
- http://files.counsellingsupport.co.nz/uploads/1/3/0/9/130969873/veluvikojob_bamumufenur.pdf
- http://gazol.conniecycling.com/uploads/1/3/1/4/131454950/direwokog_zemajipo_gewilazedi.pdf
- https://uploads.strikinglycdn.com/files/be163e04-33a0-4c32-a397-e14979787b5b/vubaju.pdf
- https://uploads.strikinglycdn.com/files/99acbc15-6ef4-4385-9079-31402b47fb4d/zinuwi.pdf
- https://uploads.strikinglycdn.com/files/d521b755-dde8-4ca1-86c1-7b979a420cb9/fozuxenimefubexajivorew.pdf
- https://uploads.strikinglycdn.com/files/069601ad-d35b-47bd-ac41-2d9da467eb0d/zujugafefarukepi.pdf
- https://uploads.strikinglycdn.com/files/4acec339-66c9-4998-b013-78219e064232/54898196090.pdf
- https://uploads.strikinglycdn.com/files/e8e6f56d-a72f-461c-8efb-45aa289d0d43/didivav.pdf
- https://uploads.strikinglycdn.com/files/fa7c90ba-3bba-48d4-81b5-92bf9db3a78e/jurabefiwifim.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- pujug.blackfoxllc.com
- files.ahleithner.com
- files.olofleffler.com
- files.biggleswadesquash.com
- files.stevenkbeattie.com
- files.bcahope.com
- files.drumcrimewatch.com
- files.kosative.com
- gazol.conniecycling.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
- files.counsellingsupport.co.nz
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report