SUSPICIOUS — tuweboremelabudewerovik.pdf
SUSPICIOUS — tuweboremelabudewerovik.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
efd5528ee16931b39708ee0a05b6a788d0aef90d3c61b9ccb31df0d8c3dac0a3 - SHA-1:
b2ad76b82a961c107c6e8d5fd82b496183f42187 - MD5:
a05a60471b615c4c5bcf855ff4827979 - ssdeep:
768:VgGzpDnphp8zQa0IdEUTSvHLEwCrvKL3AJ/kqQ3fMGjuH+R8y:GGFDplHEwCrCL3m/vGbC+R8y - TLSH:
T121327DF340A7ED8C7E8EAF079EA7156C618AC38C21269B90148C772DC4BC5ED2E15661 - Submitted as: tuweboremelabudewerovik.pdf
- File type: pdf · Size: 43510 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/strik?keyword=number+flashcards+1-20+printable, https://cdn-cms.f-static.net/uploads/4369318/normal_5f8be18cf3403.pdf, https://cdn-cms.f-static.net/uploads/4379626/normal_5f8c281d4f900.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/strik?keyword=number+flashcards+1-20+printable
- https://s3.amazonaws.com/paxivogedewilu/56481403173.pdf
- https://s3.amazonaws.com/zuxadol/bifamigovevasoxomas.pdf
- https://s3.amazonaws.com/fasanag/fasipixizozitikomu.pdf
- https://s3.amazonaws.com/pazifetanegapu/the_art_of_storytelling_john_walsh.pdf
- https://s3.amazonaws.com/sugaguxagu/soxefexipelewe.pdf
- https://s3.amazonaws.com/subud/doh_health_calendar_2019_philippines.pdf
- https://s3.amazonaws.com/wilugugo/fuwolojadawetatavu.pdf
- https://cdn-cms.f-static.net/uploads/4369318/normal_5f8be18cf3403.pdf
- https://cdn-cms.f-static.net/uploads/4379626/normal_5f8c281d4f900.pdf
- https://cdn-cms.f-static.net/uploads/4368221/normal_5f8ca8eedd7b7.pdf
- https://cdn-cms.f-static.net/uploads/4365619/normal_5f881c9d27c60.pdf
- https://cdn-cms.f-static.net/uploads/4368222/normal_5f87d7ec88a10.pdf
- https://uploads.strikinglycdn.com/files/b76e38f7-295a-4b9f-a50c-e933146951a8/tobar.pdf
- https://uploads.strikinglycdn.com/files/3c4dcdeb-ab14-42ff-8b4b-e5d1bc9ad596/sefimovekokujosikulave.pdf
- https://cdn-cms.f-static.net/uploads/4369773/normal_5f8bd10bda0e5.pdf
- https://cdn-cms.f-static.net/uploads/4365660/normal_5f8a4285e3d2e.pdf
- https://cdn-cms.f-static.net/uploads/4366359/normal_5f8d566e7fcb0.pdf
- https://uploads.strikinglycdn.com/files/08aa9c5b-6c9b-461f-9dd0-cee38b2bc3c7/gagitigamisozab.pdf
- https://uploads.strikinglycdn.com/files/fb947432-5729-48c4-b900-0779ef88761f/woregifut.pdf
- https://uploads.strikinglycdn.com/files/fdf6bf27-996a-40cf-8217-6e88e6c9829d/mosisilivagigopawadekuvax.pdf
- https://uploads.strikinglycdn.com/files/316ecbc8-95a4-4ddb-9fcd-41c4d6720c0c/rogufijorejitupomiwod.pdf
- https://uploads.strikinglycdn.com/files/d493dbfc-a0c2-4f29-a6ae-dc66162dbc5b/mumeliluvuli.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- cctraff.ru
- s3.amazonaws.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report