MALICIOUS — novopi.pdf

MALICIOUS — novopi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 6cd1cbf2ebfba64cf49dbad8cbb5d4d5b67af0542df031025ccef220f0334612
• SHA-1: 994d60604f4290463f730286a5c13b64903f7d64
• MD5: 561b2b9a5aeb2d99be4b026f0af40ae3
• ssdeep: 1536:rGFDGB4vB7AtUnN0iMrVbNmPJu+qc99SXWybF:KFD5vB7uU6bBmPInc99SXdF
• TLSH: T14233BFF714A7DC4C3781EF136DEA2826A549D7882032AA7514C87B6CC5B83BC6E50E61
• Submitted as: novopi.pdf
• File type: pdf · Size: 51999 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=b.+ed+physical+science+notes+in+hindi+pdf, http://futuzawu.pedahzur.com/uploads/1/3/1/4/131454526/ligadu.pdf, http://mefoxapom.euro-fbp.org/uploads/1/3/1/3/131380908/fae13.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=b.+ed+physical+science+notes+in+hindi+pdf
• http://futuzawu.pedahzur.com/uploads/1/3/1/4/131454526/ligadu.pdf
• http://mefoxapom.euro-fbp.org/uploads/1/3/1/3/131380908/fae13.pdf
• http://files.johb.org/uploads/1/3/0/7/130739871/budexifulaz.pdf
• http://nifob.sophiehacker.com/uploads/1/3/0/9/130969663/wufebesiwo-xajimozab-wakifinavobu-zupesune.pdf
• http://piwujafor.all-haven.com/uploads/1/3/1/8/131856632/pogibifixujir-fimoliwutiv-jebekowidaramo.pdf
• https://cdn.shopify.com/s/files/1/0440/0375/4142/files/the_stranger_by_chris_van_allsburg.pdf
• https://cdn.shopify.com/s/files/1/0452/0319/4007/files/32936968278.pdf
• https://uploads.strikinglycdn.com/files/a78ddd57-07a7-4f3f-a9bf-98397205a4b2/gesidazazabevedidiwak.pdf
• https://uploads.strikinglycdn.com/files/72268cb4-f6be-421a-9d81-5ae3d2b7feb5/xewititujibuv.pdf
• https://uploads.strikinglycdn.com/files/73f18bbf-98ac-4a9c-ab90-99a87f15e281/tizopovupoxalagikemotope.pdf
• https://uploads.strikinglycdn.com/files/db5f178e-b81b-4249-b6f6-7a211504c85b/48689188034.pdf
• https://uploads.strikinglycdn.com/files/ca0c2460-1010-488d-87b9-9cd175d77958/5403749388.pdf
• https://uploads.strikinglycdn.com/files/3bb331e1-411a-4f16-b23f-8b75929834ef/butibotokiletolugu.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• futuzawu.pedahzur.com
• mefoxapom.euro-fbp.org
• files.johb.org
• nifob.sophiehacker.com
• piwujafor.all-haven.com
• cdn.shopify.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report