SUSPICIOUS — sesigibowu.pdf

SUSPICIOUS — sesigibowu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: f57a5e24209354f29a9d8a49c09b01f6b4bfac9bc276399c453fe3e526c07e0a
• SHA-1: 8d4a7bb0295a777e717bc207b417685d558fa20e
• MD5: fc1263904d7f7c45f7888a3c9af4cb90
• ssdeep: 1536:U+GF5rJxR1EepJ/TCDMY1ZDs1JSc3VyU0wfwVJ:UnF53RXJTCwY1ZDyJScJNI
• TLSH: T1BD35CFF39867DD9DB5C5AB436DAA1489758AD2C47232A77018D87B2CC0BC3FD6E10821
• Submitted as: sesigibowu.pdf
• File type: pdf · Size: 60569 bytes
• Verdict: suspicious (44/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=java+resttemplate+x-+www-+form-+urlencoded, http://files.treesurgeonmayo.com/uploads/1/3/2/6/132682758/75b071653aedd4c.pdf, http://tugufi.atischphotography.com/uploads/1/3/0/8/130874474/3117482bff.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/strik?keyword=java+resttemplate+x-+www-+form-+urlencoded
• http://files.treesurgeonmayo.com/uploads/1/3/2/6/132682758/75b071653aedd4c.pdf
• http://tugufi.atischphotography.com/uploads/1/3/0/8/130874474/3117482bff.pdf
• http://fudujum.akakeb.com/uploads/1/3/0/7/130775934/duvoragusipunizajeni.pdf
• http://befoguduj.manfreditodance.com/uploads/1/3/1/3/131398140/9492114.pdf
• http://files.theolivegrovecmc.com/uploads/1/3/1/6/131606284/5552343.pdf
• https://site-1037233.mozfiles.com/files/1037233/19830678617.pdf
• https://site-1041169.mozfiles.com/files/1041169/3561363945.pdf
• https://site-1039129.mozfiles.com/files/1039129/52007753956.pdf
• https://site-1036969.mozfiles.com/files/1036969/84016583231.pdf
• http://files.josemleyva.com/uploads/1/3/0/7/130775368/xubutidodupafebak.pdf
• http://files.lakewoodveterans.org/uploads/1/3/1/3/131379219/likowogober-nojafukeja-nebakoxurav-gekukezenu.pdf
• http://telubes.glassfloatproject.com/uploads/1/3/1/4/131453648/vikutozinumif.pdf
• http://files.appleyardarts.com/uploads/1/3/2/3/132302858/9acdde962d58.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• files.treesurgeonmayo.com
• tugufi.atischphotography.com
• fudujum.akakeb.com
• befoguduj.manfreditodance.com
• files.theolivegrovecmc.com
• site-1037233.mozfiles.com
• site-1041169.mozfiles.com
• site-1039129.mozfiles.com
• site-1036969.mozfiles.com
• files.josemleyva.com
• files.lakewoodveterans.org
• telubes.glassfloatproject.com
• files.appleyardarts.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report