SUSPICIOUS — rurabapulakusuwodebuw.pdf

SUSPICIOUS — rurabapulakusuwodebuw.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ee318614db9aaad6cd5e4ba7e3b256538a7e92bfc2ba15ec11c7d0a7148afd16
• SHA-1: 76e80e00f88f41726f8d0be2af964ca33e84fbb0
• MD5: 72565975991ab3b1798321164ba3affc
• ssdeep: 768:SgGzpDMMW1AKLztPmVj3kmO8xsZhu510JO2EDoXFLdOWFE9Y/xO1bkYO:PGFwM8wVj3ROWsZY510vEEXFLdOWFEG3
• TLSH: T197329FF310A7DC8C6ACAAF036DEA145DA089C28C70369A7144D9772CD8BC6FDAE50951
• Submitted as: rurabapulakusuwodebuw.pdf
• File type: pdf · Size: 47051 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=calligraphy+letter+practice+pdf, https://cdn.shopify.com/s/files/1/0427/9956/2911/files/assembler_des_en_un_seul_mac.pdf, https://cdn.shopify.com/s/files/1/0429/1028/5990/files/best_law_of_attraction_books_2018.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/strik?keyword=calligraphy+letter+practice+pdf
• https://cdn.shopify.com/s/files/1/0427/9956/2911/files/assembler_des_en_un_seul_mac.pdf
• https://cdn.shopify.com/s/files/1/0429/1028/5990/files/best_law_of_attraction_books_2018.pdf
• https://cdn.shopify.com/s/files/1/0432/3144/5156/files/bexar_county_property_tax_over-65_exemption.pdf
• https://uploads.strikinglycdn.com/files/bcbbc2b5-833b-48b2-b0d5-f533df6fffb2/gifawiwo.pdf
• https://uploads.strikinglycdn.com/files/7bc97ad1-68cb-4dc3-ad9c-0902898326de/goveb.pdf
• https://uploads.strikinglycdn.com/files/aae315e0-b4c0-4080-acfb-d861895c9973/jifukubesimobaxonifib.pdf
• https://uploads.strikinglycdn.com/files/a92b4223-6a30-403c-b08d-c0017f266263/somifudozamebanemuzigase.pdf
• https://uploads.strikinglycdn.com/files/ed1b13f5-f123-49ed-bf4b-e1da582ccab2/89368135295.pdf
• http://gujofim.uptomogood.com/uploads/1/3/1/8/131856427/xineziwaw.pdf
• http://files.greatchishillpc.com/uploads/1/3/1/4/131453512/82cf728241bfcc8.pdf
• http://vopal.gnanabodhiniprimary.com/uploads/1/3/1/4/131438405/jivik.pdf
• http://vimub.morrissuperherorun.org/uploads/1/3/1/4/131438563/jajutejola.pdf
• http://tinanawa.masterclass-editing.com/uploads/1/3/1/0/131070374/kumatadexeg.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• cdn.shopify.com
• uploads.strikinglycdn.com
• gujofim.uptomogood.com
• files.greatchishillpc.com
• vopal.gnanabodhiniprimary.com
• vimub.morrissuperherorun.org
• tinanawa.masterclass-editing.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report