SUSPICIOUS — nikopet.pdf
SUSPICIOUS — nikopet.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
0921ba81b83b6e0710228182b1d01aa7944ecfd471d26912373beefb7812e846 - SHA-1:
8d102b5a8cc1ac30f9e074d751f6243c64626e83 - MD5:
8cc1a59a3765782cf3e36fbda48b8683 - ssdeep:
1536:/GFaQeMTIRiaaeHoIdQJY4N1/Z7RVYqOkJD/28STRfCv8qS31hLU:uFZejae2JHN1x7RbnD/28MsPSF6 - TLSH:
T1F436AFF760A3ED4C778B9F579CBA049A258A938C6035D7A04588773CC0BC6ED3E11A61 - Submitted as: nikopet.pdf
- File type: pdf · Size: 69495 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=small%20business%20proposal%20sample%20pdf, https://fotejisatowonu.weebly.com/uploads/1/3/2/3/132302873/vuzilulipavu.pdf, https://wosezobar.weebly.com/uploads/1/3/1/8/131856012/2047907.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=small%20business%20proposal%20sample%20pdf
- https://s3.amazonaws.com/gupuso/ganorekugevedusobubaxi.pdf
- https://s3.amazonaws.com/kiwopusafize/nudexozipetojawokikotegor.pdf
- https://s3.amazonaws.com/wilugugo/88786307390.pdf
- https://s3.amazonaws.com/dotivaf/equivalent_fractions_worksheet_ks2.pdf
- https://s3.amazonaws.com/xanebavifamopez/61642116533.pdf
- https://fotejisatowonu.weebly.com/uploads/1/3/2/3/132302873/vuzilulipavu.pdf
- https://wosezobar.weebly.com/uploads/1/3/1/8/131856012/2047907.pdf
- https://s3.amazonaws.com/lupuvogotog/94049199481.pdf
- https://s3.amazonaws.com/purixifusipelid/vamerapet.pdf
- https://s3.amazonaws.com/jasadavebaga/zubafiserusejuraz.pdf
- https://s3.amazonaws.com/pasawexawinogad/cholesterol_synthesis.pdf
- https://s3.amazonaws.com/jeworurowam/aspergillus_flavus_characteristics.pdf
- https://s3.amazonaws.com/fowikorejodi/britannica_encyclopedia_2010.pdf
- https://s3.amazonaws.com/jufowokedunod/dubagosazu.pdf
- https://cdn-cms.f-static.net/uploads/4374009/normal_5f9803c03c8af.pdf
- https://cdn-cms.f-static.net/uploads/4373281/normal_5f8d70de4009d.pdf
- https://cdn-cms.f-static.net/uploads/4367289/normal_5f87c02b9f864.pdf
- https://cdn-cms.f-static.net/uploads/4401971/normal_5f90f03a43296.pdf
- https://cdn-cms.f-static.net/uploads/4366324/normal_5f95a447300c9.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/b4b3eb38b.pdf
- https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/d1ee3c84.pdf
- https://rosofofupamufi.weebly.com/uploads/1/3/4/3/134364257/9556598.pdf
- https://buximinolid.weebly.com/uploads/1/3/1/3/131381316/fupipej-xekotumujupalu-mawejozujuk-digad.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- s3.amazonaws.com
- fotejisatowonu.weebly.com
- wosezobar.weebly.com
- cdn-cms.f-static.net
- gimejexoxixaza.weebly.com
- jawasolasazilem.weebly.com
- rosofofupamufi.weebly.com
- buximinolid.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report