MALICIOUS — zarifunirukatu.pdf

MALICIOUS — zarifunirukatu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 54 detection engines flagged it.

Identification

• SHA-256: cf8bb873cd64a5f24d8c22878517728bdf75ee5737560957176714295955b795
• SHA-1: 2f96094dbf94e8d0c6a2fd6fb5417d5ade7ff1dc
• MD5: a572d49c69ec7059b474c7d1ccfb0cd3
• ssdeep: 768:xgGzpDH3y3VJsmK0GMUiWpaMzzalomBo0I5PSWJZUMqCC69m9hZM:CGFzK2mBZIZpJZUMqv6mhZM
• TLSH: T1FD319EF790A7EC4D7A87AB03ACE610595489D78DB237A7200589372CC47C5FDBE509A0
• Submitted as: zarifunirukatu.pdf
• File type: pdf · Size: 41296 bytes
• Verdict: malicious (78/100)

Detections (2 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=if+formula+in+excel+2007+with+example+pdf, https://uploads.strikinglycdn.com/files/41a37544-87da-4094-b11e-345b88877c03/31217372611.pdf, https://uploads.strikinglycdn.com/files/c1b7f9ae-098f-485a-9f36-70bf55c6b8e8/tabamikebu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/strik?keyword=if+formula+in+excel+2007+with+example+pdf
• https://uploads.strikinglycdn.com/files/41a37544-87da-4094-b11e-345b88877c03/31217372611.pdf
• https://uploads.strikinglycdn.com/files/c1b7f9ae-098f-485a-9f36-70bf55c6b8e8/tabamikebu.pdf
• https://uploads.strikinglycdn.com/files/4e8c4063-db88-4da0-9d8b-37fbb3c8cbd2/ruxexutadule.pdf
• https://uploads.strikinglycdn.com/files/1776fd3b-eb85-453c-ab59-63ec7b44ceef/bivizoxebavunimivimedoto.pdf
• https://cdn.shopify.com/s/files/1/0433/6300/8664/files/profesora_de_ingles_acusada_de_sodof.pdf
• https://cdn.shopify.com/s/files/1/0432/3858/8584/files/90471260916.pdf
• https://cdn.shopify.com/s/files/1/0429/8299/8170/files/wupajiwawixavobenodajabev.pdf
• https://cdn.shopify.com/s/files/1/0430/0547/7023/files/5761564735.pdf
• https://cdn.shopify.com/s/files/1/0435/3340/2266/files/fasavisofejeraxasojabofa.pdf
• https://cdn.shopify.com/s/files/1/0435/0479/5800/files/chellame_movie_songs_masstamilan.pdf
• https://cdn.shopify.com/s/files/1/0479/5190/4924/files/31929810113.pdf
• https://cdn.shopify.com/s/files/1/0429/5491/6006/files/torch_browser_for_pc_filehippo.pdf
• https://cdn.shopify.com/s/files/1/0431/8871/5682/files/kiwetabapaletisetajolepo.pdf
• https://cdn.shopify.com/s/files/1/0433/8306/2678/files/29398263603.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• uploads.strikinglycdn.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report