SUSPICIOUS — fokoxegitob.pdf
SUSPICIOUS — fokoxegitob.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
262be0ef11ac12062034295c67eb9ba14e266f3585af51f0a891f89816e35259 - SHA-1:
45069c0e733ef1248514b441f53f4cb64867a921 - MD5:
522e77b0429b08cdcb027501fb5592aa - ssdeep:
768:rgGzpDBptU8Gzrw4vRwy/OD1lyCtQov7bnniD5RO7bjxxIeiYohm1y5x9Zyt:UGFlpyZw4v21DlvHnE51Nhm1yH9Zyt - TLSH:
T12833AFF354A7ED8D7B86AF13BDBA14516185C348623397A048D86B6CD0BC2ADBE10D50 - Submitted as: fokoxegitob.pdf
- File type: pdf · Size: 52103 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=tipos%20de%20suelos%20en%20mexico%20pdf, https://uploads.strikinglycdn.com/files/f8f05a93-fb64-48b4-aa75-0ce1a1562209/rugafubifikakor.pdf, https://uploads.strikinglycdn.com/files/defb12ac-a72a-4549-8f24-34dbb4b01daf/formula_de_karvonen_frecuencia_cardi.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=tipos%20de%20suelos%20en%20mexico%20pdf
- https://uploads.strikinglycdn.com/files/f8f05a93-fb64-48b4-aa75-0ce1a1562209/rugafubifikakor.pdf
- https://uploads.strikinglycdn.com/files/defb12ac-a72a-4549-8f24-34dbb4b01daf/formula_de_karvonen_frecuencia_cardi.pdf
- https://uploads.strikinglycdn.com/files/0177326e-4f16-4040-8fda-88c1f8312731/rurikogoxewuxirolutedomip.pdf
- https://uploads.strikinglycdn.com/files/5efad415-0e65-4da9-9713-8c8ad26845c8/construction_jobsite_management_fourth_edition.pdf
- https://uploads.strikinglycdn.com/files/61224e2e-14c0-42ed-992f-1b2111ab4df9/kubebolulijik.pdf
- https://cdn-cms.f-static.net/uploads/4366063/normal_5f90c6dd90e8a.pdf
- https://cdn-cms.f-static.net/uploads/4366637/normal_5f883fac9597a.pdf
- https://s3.amazonaws.com/fasanag/virezewotedibidedixive.pdf
- https://s3.amazonaws.com/wilugugo/best_biodata_format_for_job.pdf
- https://s3.amazonaws.com/leguvefu/duties_of_sales_engineer.pdf
- https://s3.amazonaws.com/mijedusovineti/edward_snowden_book_free.pdf
- https://cdn.shopify.com/s/files/1/0437/7814/6462/files/94572180037.pdf
- https://cdn.shopify.com/s/files/1/0437/6975/7850/files/positive_words_that_start_with_white.pdf
- https://cdn.shopify.com/s/files/1/0498/0044/6113/files/firumi.pdf
- https://cdn.shopify.com/s/files/1/0483/0219/4849/files/johnny_test_intro_tab.pdf
- https://cdn.shopify.com/s/files/1/0486/4170/4104/files/climatizador_consul_c1f05ab_manual.pdf
- https://uploads.strikinglycdn.com/files/dfa5b350-fef4-4fca-bc7e-6b3bae145530/50604704907.pdf
- https://uploads.strikinglycdn.com/files/1e96f6c6-8b82-4b45-b243-2bc7a745e587/tazusavil.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- s3.amazonaws.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report