MALICIOUS — gaxirozitenixufike.pdf

MALICIOUS — gaxirozitenixufike.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: bc9e188e06fbb26cc30df2572da44b1edfadf723423468dc08782b69f40fed59
SHA-1: c96b0a02dc5f3040a132eba0a38db65f29adb64b
MD5: d8f3a9195f65c424b9e68392c3b7fb0f
ssdeep: 768:YgGzpDpPiM5gMLDCx4Zk7llPVOzFaiFj+Rbno7p/aKV5hUqTCuh6zKjZ:1GF1PY4C7btOzYi1+dnuaKDupu0mZ
TLSH: T14F33CFF351DBED8C7D86EB13A9B611A9728AC7886132C76408CC776DC07C6BD6E00951
Submitted as: gaxirozitenixufike.pdf
File type: pdf · Size: 51897 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gettraff.ru/strik?keyword=rest+api+testing+using+postman+pdf, http://files.nepcoawards.com/uploads/1/3/2/7/132740270/jifowamifezabodifo.pdf, http://fodowafut.candacesam.com/uploads/1/3/1/4/131407283/tudugezem.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://gettraff.ru/strik?keyword=rest+api+testing+using+postman+pdf
http://files.nepcoawards.com/uploads/1/3/2/7/132740270/jifowamifezabodifo.pdf
http://fodowafut.candacesam.com/uploads/1/3/1/4/131407283/tudugezem.pdf
http://wumited.thatweddingninja.com/uploads/1/3/2/6/132681504/51bfb8.pdf
http://files.lisa-rivers.com/uploads/1/3/1/3/131379559/sesow_zewofilijinox_buviwaxajiko_xiluditetom.pdf
http://simedise.bardstowncf.org/uploads/1/3/1/4/131482826/8243269.pdf
https://uploads.strikinglycdn.com/files/0e5e52bd-730f-4877-a836-01f1a0e3655f/63768794845.pdf
https://uploads.strikinglycdn.com/files/f763d8ea-8175-4511-a5a2-31d38474162b/doravoranumurulu.pdf
https://uploads.strikinglycdn.com/files/322b8f13-ecfe-4d1d-a916-8c6a7288c25b/gubunipukumivozalugija.pdf
https://uploads.strikinglycdn.com/files/35a51f7c-0f64-4ece-b377-3938b54d05f5/jedari.pdf
https://uploads.strikinglycdn.com/files/04861283-a37b-4762-943a-8fad02e671c5/nizedilifilinikabelo.pdf
https://uploads.strikinglycdn.com/files/60d98b68-f0a3-438e-afff-51357d79b49f/62670668751.pdf
https://uploads.strikinglycdn.com/files/4b6f2334-2b3a-4b62-8738-6da26daaf916/xofikin.pdf
https://cdn.shopify.com/s/files/1/0432/9455/6324/files/7346296493.pdf
https://cdn.shopify.com/s/files/1/0430/2176/2723/files/senanutabelariwifigoge.pdf
https://cdn.shopify.com/s/files/1/0486/0923/1006/files/ice_bears_schedule.pdf
https://cdn.shopify.com/s/files/1/0444/5123/3959/files/jonevafoxazarovoto.pdf
https://cdn.shopify.com/s/files/1/0477/0824/2079/files/7028912267.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

gettraff.ru
files.nepcoawards.com
fodowafut.candacesam.com
wumited.thatweddingninja.com
files.lisa-rivers.com
simedise.bardstowncf.org
uploads.strikinglycdn.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report