MALICIOUS — wekikesoturanob.pdf

MALICIOUS — wekikesoturanob.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: fa4bfffe57ddc476938747cd1189c9c09288cc43ff14eb7e1cb911131d8bba05
• SHA-1: 794b6f04046988395a64533e3aae8f0fda451949
• MD5: 2da18dc430eccffb7aa868961bc7235e
• ssdeep: 768:qjgGzpDCpj26iSyRPRc+WX0HejhxTHnUOpzcl8rn:3GF2pjO3HuhlHUOhS8rn
• TLSH: T139309EF71167ED8C7A8AAB0399EB105E6045878D6132D6A491D8377CC4BC1FC2F80A74
• Submitted as: wekikesoturanob.pdf
• File type: pdf · Size: 38753 bytes
• Verdict: malicious (70/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://cctraff.ru/strik?keyword=app+dj+pad+terbaik+android, https://site-1039503.mozfiles.com/files/1039503/92187150971.pdf, https://site-1039562.mozfiles.com/files/1039562/38318699694.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/strik?keyword=app+dj+pad+terbaik+android
• https://site-1039503.mozfiles.com/files/1039503/92187150971.pdf
• https://site-1039562.mozfiles.com/files/1039562/38318699694.pdf
• https://site-1037274.mozfiles.com/files/1037274/febuke.pdf
• https://site-1036826.mozfiles.com/files/1036826/kebixevejoworopokan.pdf
• https://site-1040322.mozfiles.com/files/1040322/13788089506.pdf
• https://uploads.strikinglycdn.com/files/e273e3cc-c386-4f06-bce0-7972aad05122/69293994678.pdf
• https://site-1040374.mozfiles.com/files/1040374/suwaxipurimisiw.pdf
• https://site-1038629.mozfiles.com/files/1038629/86091075571.pdf
• https://uploads.strikinglycdn.com/files/e908b722-ca20-4c20-89dc-dd7e4624ab26/21139869751.pdf
• https://uploads.strikinglycdn.com/files/b06d8477-bfd0-4928-b6ed-00e4ef8c98c4/sepogujew.pdf
• https://uploads.strikinglycdn.com/files/ad67ff03-ca0b-476a-95e8-48b6af3240ae/kamawasimarawopudapaze.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• site-1039503.mozfiles.com
• site-1039562.mozfiles.com
• site-1037274.mozfiles.com
• site-1036826.mozfiles.com
• site-1040322.mozfiles.com
• uploads.strikinglycdn.com
• site-1040374.mozfiles.com
• site-1038629.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report