SUSPICIOUS — fepinoxur.pdf
SUSPICIOUS — fepinoxur.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
1c981a4f229c6626ecd2f6ccd3a2b59c14d8be013d64d7ac2ce58c709d9e182f - SHA-1:
77cac1d303c125751f9313535c924daf3127a702 - MD5:
00e7f5babda052cfe6efc6d0861f8bb3 - ssdeep:
768:8gGzpD1p0MPNq5E5tVb/NUwkq8lW5RAKo/0PPNikqYQ74bZSqVDBJk0HNRfmhm:ZGFBpjg5snNibr74bQsDrk0tBmhm - TLSH:
T157327DF310A7ED4D7A8B9B176EAB1169B08AD78C6127D79004CC6B2CC07C6AD7F00A55 - Submitted as: fepinoxur.pdf
- File type: pdf · Size: 44490 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=minecraft+pixelmon+pokeball+crafting+guide, https://zoveponezewuda.weebly.com/uploads/1/3/0/7/130738822/2326909.pdf, https://rimesozarabef.weebly.com/uploads/1/3/1/6/131607712/vexudoris.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/strik?keyword=minecraft+pixelmon+pokeball+crafting+guide
- https://zoveponezewuda.weebly.com/uploads/1/3/0/7/130738822/2326909.pdf
- https://rimesozarabef.weebly.com/uploads/1/3/1/6/131607712/vexudoris.pdf
- https://dokodajibebabek.weebly.com/uploads/1/3/2/3/132302773/nesibuganut.pdf
- https://pevugubak.weebly.com/uploads/1/3/2/7/132740457/be69f337ab5276.pdf
- https://rajaxamakato.weebly.com/uploads/1/3/2/3/132302926/gunavalojo-sixegokoziwitu-paxuse-zogivase.pdf
- https://cdn-cms.f-static.net/uploads/4369774/normal_5f889f8a12b27.pdf
- https://cdn-cms.f-static.net/uploads/4365552/normal_5f8701775e7f9.pdf
- https://cdn-cms.f-static.net/uploads/4381082/normal_5f8b4f0366166.pdf
- https://cdn-cms.f-static.net/uploads/4365657/normal_5f87c0043c632.pdf
- https://cdn-cms.f-static.net/uploads/4366371/normal_5f90a7826a85d.pdf
- https://cdn-cms.f-static.net/uploads/4367656/normal_5f87c591c522f.pdf
- https://cdn-cms.f-static.net/uploads/4371523/normal_5f90a19b24145.pdf
- https://cdn-cms.f-static.net/uploads/4366018/normal_5f90a7388bb16.pdf
- https://cdn-cms.f-static.net/uploads/4368740/normal_5f8984047b100.pdf
- https://cdn-cms.f-static.net/uploads/4387931/normal_5f8eb3415d1b6.pdf
- https://cdn.shopify.com/s/files/1/0433/5448/8990/files/41313243143.pdf
- https://cdn.shopify.com/s/files/1/0469/0758/8768/files/numuzoduzerusa.pdf
- https://cdn.shopify.com/s/files/1/0500/5328/4008/files/apk_editor_pro_full_cracked.pdf
- https://cdn.shopify.com/s/files/1/0497/5221/1620/files/where_did_iowa_wrestle_in_1980s.pdf
- https://cdn.shopify.com/s/files/1/0492/2812/0217/files/cold_steel_machete_katana.pdf
- https://uploads.strikinglycdn.com/files/f3b58bf2-57d8-4798-aec7-5d3894151162/45720361525.pdf
- https://uploads.strikinglycdn.com/files/1ba5843d-e86c-4909-8f24-837f757afa8f/80922020530.pdf
- https://uploads.strikinglycdn.com/files/a493664b-ee08-4cf3-ba90-4e11e130e5e4/24316826736.pdf
- https://s3.amazonaws.com/vukumesoj/american_english_file_teacher_s_book_5.pdf
Embedded domains
- gettraff.ru
- zoveponezewuda.weebly.com
- rimesozarabef.weebly.com
- dokodajibebabek.weebly.com
- pevugubak.weebly.com
- rajaxamakato.weebly.com
- cdn-cms.f-static.net
- cdn.shopify.com
- uploads.strikinglycdn.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report