SUSPICIOUS — teporu-tixipavodupesu-lazibisawuz-buxezog.pdf
SUSPICIOUS — teporu-tixipavodupesu-lazibisawuz-buxezog.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f20cd8d47e7764a3dd8fd576269f6cc2c8794c3bec92e61e1dd770a256a42882 - SHA-1:
5302265ddb9f01ffdf9518c38f187f24872023cd - MD5:
f1456db884dd050d53b5543f584d2fa9 - ssdeep:
768:BgGzpDCpJgrRRVs2/eGY9GdEkzgJr/kC8kM1Es9/eRGxb04TN/Rnm:yGFOpJNkQsC8n1EsxqGxb0ARRnm - TLSH:
T1AE328CF31093EC8C7987EB03ADEA255D9189D6486232E7A0458C7B6DC07C7BDBE90950 - Submitted as: teporu-tixipavodupesu-lazibisawuz-buxezog.pdf
- File type: pdf · Size: 43747 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/8864c4ed-b022-4ecf-ac3b-3abe4ee7a929/98509719176.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=skyrim%20name%20generator%20breton, https://cdn.shopify.com/s/files/1/0482/5645/0714/files/gregorio_del_pilar_movie.pdf, https://cdn.shopify.com/s/files/1/0435/2661/9287/files/department_56_value_guide_2017.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=skyrim%20name%20generator%20breton
- https://cdn.shopify.com/s/files/1/0482/5645/0714/files/gregorio_del_pilar_movie.pdf
- https://cdn.shopify.com/s/files/1/0435/2661/9287/files/department_56_value_guide_2017.pdf
- https://cdn.shopify.com/s/files/1/0496/1648/6549/files/62398404197.pdf
- https://cdn.shopify.com/s/files/1/0434/2385/8845/files/worlds_hardest_game_speedrun.pdf
- https://uploads.strikinglycdn.com/files/1755df28-fe17-4051-9dcf-0a06333ae9b1/janorilixifilamoza.pdf
- https://uploads.strikinglycdn.com/files/9110d4e7-030e-41bf-9f02-451ccdb9c943/rojubukusibikanubed.pdf
- https://uploads.strikinglycdn.com/files/8864c4ed-b022-4ecf-ac3b-3abe4ee7a929/98509719176.pdf
- https://uploads.strikinglycdn.com/files/82611522-3b2e-4397-837c-d122ca83a492/zibuxuzomilovonexumodoxum.pdf
- https://uploads.strikinglycdn.com/files/c412d8ca-f4b7-47be-af10-9c47c5a3596a/karori.pdf
- https://uploads.strikinglycdn.com/files/717d7f14-0f54-4f78-b058-37e62092a1e0/fenapijuzelanubifa.pdf
- https://uploads.strikinglycdn.com/files/3a915ae5-0799-48f1-8aaf-9dcffb0149bc/40053196675.pdf
- https://uploads.strikinglycdn.com/files/da3c70b7-cdd6-45b2-90b0-1ce8e1ddf392/wiwififoligogarasatub.pdf
- https://uploads.strikinglycdn.com/files/a9c03f93-af37-4e92-a28c-6dc852cba29a/lezekaxafuvusejoxanumot.pdf
- https://uploads.strikinglycdn.com/files/2ad22202-6829-4db7-9e3e-d39c5b6a98ef/xafapifasukovorebebo.pdf
- https://site-1039725.mozfiles.com/files/1039725/fevidu.pdf
- https://site-1040095.mozfiles.com/files/1040095/xosulategofadot.pdf
- https://cdn.shopify.com/s/files/1/0432/2276/1635/files/swtor_level_70_boost.pdf
- https://cdn.shopify.com/s/files/1/0496/7700/9060/files/is_gideon_from_criminal_minds_still_alive.pdf
- https://cdn.shopify.com/s/files/1/0437/6743/1329/files/keragojinarikelofi.pdf
- https://cdn.shopify.com/s/files/1/0481/2796/7395/files/79523782264.pdf
- https://cdn.shopify.com/s/files/1/0438/4676/2656/files/sample_letter_proof_of_dependency.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- site-1039725.mozfiles.com
- site-1040095.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report