SUSPICIOUS — forijatibu.pdf
SUSPICIOUS — forijatibu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
fd716274981fa8c62e8474dc3b22decca850beb096c78def7d9fa0b8f8b6f19c - SHA-1:
ef35f5b5f86d776380849fd90f258c82e1c35529 - MD5:
d9ba466eda96c2c02a1ec8b4c1cafea0 - ssdeep:
768:lgGzpD6ZLw47IekTDEBht7V3MyVaPz/RZNxrGpb22QZd2u58o+cDK6dezWnyTfSx:2GF+9kHc3MHDz6pi2QZ558xY0WyT6x - TLSH:
T1C9349EF34197DC8CBACBAB17ADAA105561CAD78C713397B04488B76DC4BC2AC6E14960 - Submitted as: forijatibu.pdf
- File type: pdf · Size: 52387 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/e14540b4-778c-40ac-8288-df6962cccd31/xunurunipikuworasu.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=parts%20of%20speech%20practice%20worksheets%20with%20answers, https://uploads.strikinglycdn.com/files/df685442-d437-4855-9d9b-cfc2431fb3bb/ponmana_selvan_songs_download.pdf, https://uploads.strikinglycdn.com/files/466b18ad-8fd4-40dd-9e07-a4b33461329b/how_to_use_cheat_engine_on_google_chrome_flash_games.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=parts%20of%20speech%20practice%20worksheets%20with%20answers
- https://s3.amazonaws.com/wavunot/brche_multiplikation.pdf
- https://s3.amazonaws.com/pizexopenaxu/free_download_nemo_to_word_crack.pdf
- https://s3.amazonaws.com/kisimujuk/56798419092.pdf
- https://s3.amazonaws.com/xesigeze/cbse_class_12_physics_question_paper_2012.pdf
- https://s3.amazonaws.com/zupenafud/ledijovagasuxesakilopapaj.pdf
- https://s3.amazonaws.com/jamokaroxoj/vubuf.pdf
- https://s3.amazonaws.com/petikamov/88087905837.pdf
- https://s3.amazonaws.com/jamokaroxoj/bunchy_top_in_papaya.pdf
- https://s3.amazonaws.com/sugaguxagu/aesculap_surgical_instruments_catalog.pdf
- https://s3.amazonaws.com/gupuso/branding_yourself_erik_deckers.pdf
- https://uploads.strikinglycdn.com/files/df685442-d437-4855-9d9b-cfc2431fb3bb/ponmana_selvan_songs_download.pdf
- https://uploads.strikinglycdn.com/files/466b18ad-8fd4-40dd-9e07-a4b33461329b/how_to_use_cheat_engine_on_google_chrome_flash_games.pdf
- https://uploads.strikinglycdn.com/files/c0b05e5c-b4c5-4881-b996-83bf7cbb87f5/pujumekulefax.pdf
- https://uploads.strikinglycdn.com/files/e14540b4-778c-40ac-8288-df6962cccd31/xunurunipikuworasu.pdf
- https://uploads.strikinglycdn.com/files/9a98a91d-821b-4f6a-bbcd-14af8b19575c/46748101087.pdf
- https://lewejasolon.weebly.com/uploads/1/3/1/4/131437246/buwirofabuwogelewat.pdf
- https://sobegivi.weebly.com/uploads/1/3/4/3/134311910/jigogamad.pdf
- https://soxajenukaru.weebly.com/uploads/1/3/0/8/130874283/wosijope.pdf
- https://bupiwuzisulim.weebly.com/uploads/1/3/0/8/130874125/fubizubowilibuk.pdf
- https://guburumo.weebly.com/uploads/1/3/4/3/134322172/5230666.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- gettraff.ru
- s3.amazonaws.com
- uploads.strikinglycdn.com
- lewejasolon.weebly.com
- sobegivi.weebly.com
- soxajenukaru.weebly.com
- bupiwuzisulim.weebly.com
- guburumo.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report