SUSPICIOUS — zozeji.pdf
SUSPICIOUS — zozeji.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 53 detection engines flagged it.
Identification
- SHA-256:
0996ad96d42c3c35fa845fb80ded405eb7b64b29b8651ae24a0a08756b7e7543 - SHA-1:
b95ff4e76e7b15700196ffef94bf199286647b2b - MD5:
7ea16fc6d38d2ccb88f6de978e4a1b59 - ssdeep:
768:SgGzpD4e8+hmUbY3iyEMSXaem+7kJ4pu5Ppgyl6vXC:PGFUe8R+PwMqPpR6vS - TLSH:
T151316BF710A7ED8C3ACBAF439DE61599608EC788612797904088776DC4BC9FC6F00A61 - Submitted as: zozeji.pdf
- File type: pdf · Size: 39942 bytes
- Verdict: suspicious (35/100)
Detections (1 of 53 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=ali%20demirsoy%20kitaplar%C4%B1, https://cdn-cms.f-static.net/uploads/4369920/normal_5f88c6717d3c7.pdf, https://cdn-cms.f-static.net/uploads/4365662/normal_5f86fe8f12e34.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=ali%20demirsoy%20kitaplar%C4%B1
- https://cdn-cms.f-static.net/uploads/4369920/normal_5f88c6717d3c7.pdf
- https://cdn-cms.f-static.net/uploads/4365662/normal_5f86fe8f12e34.pdf
- https://cdn-cms.f-static.net/uploads/4369317/normal_5f88cb164a8b3.pdf
- https://cdn-cms.f-static.net/uploads/4366011/normal_5f870f80a7f94.pdf
- https://uploads.strikinglycdn.com/files/bed8440a-232b-40b2-8334-0b2ebe9eb54e/46939466026.pdf
- https://uploads.strikinglycdn.com/files/d0fe846f-adbb-4684-9da7-9cbcbcab9222/61505433833.pdf
- https://uploads.strikinglycdn.com/files/b20f5d8c-bd20-45b9-8378-a6edc621b64f/lelalixofawerewujisuradog.pdf
- https://uploads.strikinglycdn.com/files/58b436a5-4465-4598-88a2-9b49d3aac111/divikinomozuwazefugen.pdf
- https://uploads.strikinglycdn.com/files/fe725621-85bf-4c86-92dc-59ad9d7ee6ce/delawu.pdf
- https://site-1043335.mozfiles.com/files/1043335/toriroroje.pdf
- https://site-1040320.mozfiles.com/files/1040320/95745963412.pdf
- https://site-1043967.mozfiles.com/files/1043967/4856732499.pdf
- https://site-1038592.mozfiles.com/files/1038592/79895884188.pdf
- https://jemiwuwavaza.weebly.com/uploads/1/3/0/8/130814288/bibesekukemugedovofa.pdf
- https://taxajadotediru.weebly.com/uploads/1/3/0/8/130873824/9089272.pdf
- https://uploads.strikinglycdn.com/files/c02cb94b-c772-408b-a644-e8d28384e45f/dixut.pdf
- https://uploads.strikinglycdn.com/files/dd4fa2d8-c723-400b-9cd4-0314980d27b3/25900656996.pdf
- https://uploads.strikinglycdn.com/files/f80c4bdc-f93c-4ed8-acd4-52ab76be3da9/xugobodelofigijotiloxasa.pdf
- https://cdn-cms.f-static.net/uploads/4365635/normal_5f872c8628f3f.pdf
- https://cdn-cms.f-static.net/uploads/4369166/normal_5f88c02861dd9.pdf
- https://cdn-cms.f-static.net/uploads/4370077/normal_5f88491a4d121.pdf
- https://cdn-cms.f-static.net/uploads/4369930/normal_5f88b22f88bf7.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- site-1043335.mozfiles.com
- site-1040320.mozfiles.com
- site-1043967.mozfiles.com
- site-1038592.mozfiles.com
- jemiwuwavaza.weebly.com
- taxajadotediru.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report