SUSPICIOUS — dexudo.pdf
SUSPICIOUS — dexudo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
244dccdf053b7173724c87a3c8b52d61c9c6bf6d21fd8129e7440ce875c2d850 - SHA-1:
f1314d46efd9ffce7fa9c5b14d490a372a869fcb - MD5:
722d5db099cacc77d8885004beace2bc - ssdeep:
768:qgGzpDxpdDLA5sIc7BPr+Xa7QVqYniOO3iBXUqPOinoGKw:3GF9pdpcaMVqWdAiBKUoGKw - TLSH:
T1E8306BF31067ED4DBA8B6B4359EB109E9489C38DA07693940588776CD1BC6BD7F10860 - Submitted as: dexudo.pdf
- File type: pdf · Size: 38548 bytes
- Verdict: suspicious (35/100)
Detections (1 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=livro%20calculo%20numerico%20pdf%20download, https://site-1043408.mozfiles.com/files/1043408/daxazovonutajawane.pdf, https://site-1043805.mozfiles.com/files/1043805/felatisudadurapene.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=livro%20calculo%20numerico%20pdf%20download
- https://site-1043408.mozfiles.com/files/1043408/daxazovonutajawane.pdf
- https://site-1043805.mozfiles.com/files/1043805/felatisudadurapene.pdf
- https://site-1039426.mozfiles.com/files/1039426/jibavazovuzidetaradobib.pdf
- https://site-1038756.mozfiles.com/files/1038756/overhaul_manual_continental_engines.pdf
- https://site-1044309.mozfiles.com/files/1044309/nazirokoroxe.pdf
- https://site-1040438.mozfiles.com/files/1040438/xomozazazifinu.pdf
- https://site-1038556.mozfiles.com/files/1038556/kabozifijutokofifupojegov.pdf
- https://site-1039775.mozfiles.com/files/1039775/wisojaxevajosuw.pdf
- https://site-1041184.mozfiles.com/files/1041184/53883352409.pdf
- https://site-1043153.mozfiles.com/files/1043153/woludipew.pdf
- https://site-1037132.mozfiles.com/files/1037132/51272541624.pdf
- https://site-1038558.mozfiles.com/files/1038558/10047577486.pdf
- https://site-1036920.mozfiles.com/files/1036920/60818103191.pdf
- https://cdn.shopify.com/s/files/1/0433/4426/5366/files/blade_and_soul_optimization_guide_needs.pdf
- https://cdn.shopify.com/s/files/1/0482/7401/4372/files/green_pasture_cod_liver_oil_review.pdf
- https://cdn.shopify.com/s/files/1/0478/2800/9119/files/ancient_bronze_dragon_5e.pdf
- https://cdn.shopify.com/s/files/1/0429/2411/4076/files/3648279550.pdf
- https://uploads.strikinglycdn.com/files/a10dd51c-959d-42e6-aed3-c14c52c58c2a/xewezemagiko.pdf
- https://uploads.strikinglycdn.com/files/73221c24-30c9-4e1e-8310-c970406712a2/37355574031.pdf
- https://uploads.strikinglycdn.com/files/e7e3e52b-db50-460d-90c0-d6ad2e978d06/vavudimobixixorelifa.pdf
- https://cdn.shopify.com/s/files/1/0266/8190/1253/files/buvisunasunesefiwa.pdf
- https://cdn.shopify.com/s/files/1/0497/5345/6804/files/52865230100.pdf
- https://cdn.shopify.com/s/files/1/0486/1804/5600/files/prada_mens_sunglasses_ebay.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- site-1043408.mozfiles.com
- site-1043805.mozfiles.com
- site-1039426.mozfiles.com
- site-1038756.mozfiles.com
- site-1044309.mozfiles.com
- site-1040438.mozfiles.com
- site-1038556.mozfiles.com
- site-1039775.mozfiles.com
- site-1041184.mozfiles.com
- site-1043153.mozfiles.com
- site-1037132.mozfiles.com
- site-1038558.mozfiles.com
- site-1036920.mozfiles.com
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report