MALICIOUS — kivagujewezeji.pdf
MALICIOUS — kivagujewezeji.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
bec00bfe2a1b90a47d6dfd82598f92f92dbab3d4940f0c16bbef766229bc3f8b - SHA-1:
6dcc14aa3d54bdfe2c5ac4b0b89682081680e28e - MD5:
505b6835699113b59de50749d22c8851 - ssdeep:
768:XZgGzpD5hO4/jtWj+M7718cweluAd7md/lttFe3cG12scsAfiwaa4jnRtKIotC:KGFlwL318jQ775MLYAlajRtrotC - TLSH:
T17C33AEF3919BDC887AC65B036EEB1549618AC388A032D7A459C8773CD4BC6FDBE14850 - Submitted as: kivagujewezeji.pdf
- File type: pdf · Size: 48210 bytes
- Verdict: malicious (88/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://gettraff.ru/strik?keyword=email+marketing+definition+pdf, https://site-1036824.mozfiles.com/files/1036824/72746246334.pdf, https://site-1036881.mozfiles.com/files/1036881/30215510417.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/strik?keyword=email+marketing+definition+pdf
- https://site-1036824.mozfiles.com/files/1036824/72746246334.pdf
- https://site-1036881.mozfiles.com/files/1036881/30215510417.pdf
- https://site-1036772.mozfiles.com/files/1036772/muvozudujedebe.pdf
- https://site-1036971.mozfiles.com/files/1036971/88297178525.pdf
- https://site-1036932.mozfiles.com/files/1036932/velumozijabimaz.pdf
- http://files.customizablecrafts.com/uploads/1/3/1/6/131636954/be58f5411f5145.pdf
- http://febikiju.monicaariasmiranda.com/uploads/1/3/1/4/131406717/a24d5f89d072b.pdf
- https://uploads.strikinglycdn.com/files/d6e8e298-ac18-4551-8275-b4bf5f24e45a/dazuvebekusofarom.pdf
- https://uploads.strikinglycdn.com/files/632185ee-a93e-47a7-b0b4-d55efb68d363/vubofirevonolabidobi.pdf
- https://uploads.strikinglycdn.com/files/4a08c3f5-adc6-41bc-a84b-3194a3b0fc2f/gewunugalogajukuxupaja.pdf
- https://uploads.strikinglycdn.com/files/63cdf255-2f3e-433f-8461-3cd3173f6c09/duzetosemowimaxogib.pdf
- http://jedibaroz.krollpatrol.com/uploads/1/3/1/6/131606420/metiza.pdf
- http://basezobe.zest-music.com/uploads/1/3/0/9/130969504/wozupujupu-mupowuwi-paseroz.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- site-1036824.mozfiles.com
- site-1036881.mozfiles.com
- site-1036772.mozfiles.com
- site-1036971.mozfiles.com
- site-1036932.mozfiles.com
- files.customizablecrafts.com
- febikiju.monicaariasmiranda.com
- uploads.strikinglycdn.com
- jedibaroz.krollpatrol.com
- basezobe.zest-music.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report