SUSPICIOUS — zimikobo_lolal_fosovonebeb_tanawe.pdf
SUSPICIOUS — zimikobo_lolal_fosovonebeb_tanawe.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
2df511387529536231e291aca7ce0a41c75cd679a7779024a0d82d94cd41734b - SHA-1:
da7b2dc5f86bb81937d99e9b939ade32baf13b7e - MD5:
556e0895d2656e687a0234db7668e74f - ssdeep:
768:cgGzpDHe7Pisu1Ol2VRSP7F6OKsFoxRhtl/6cQqTm2XeD29ooU8i+Ky/Ybwjt5X:5GFLef6zjHryqTm2XW29y8/K4Ybkt5X - TLSH:
T10B339EF300A7DD8CBA879B1369EB215A114BC788A333E7605489BB6CD57C27D7E04920 - Submitted as: zimikobo_lolal_fosovonebeb_tanawe.pdf
- File type: pdf · Size: 48911 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=wasteland%202%20la%20cienega, https://site-1040280.mozfiles.com/files/1040280/dimarekefimipi.pdf, https://site-1039508.mozfiles.com/files/1039508/soteromopuwuleruv.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=wasteland%202%20la%20cienega
- https://site-1040280.mozfiles.com/files/1040280/dimarekefimipi.pdf
- https://site-1039508.mozfiles.com/files/1039508/soteromopuwuleruv.pdf
- https://site-1038770.mozfiles.com/files/1038770/67579782328.pdf
- https://site-1041860.mozfiles.com/files/1041860/pemarolew.pdf
- https://site-1040036.mozfiles.com/files/1040036/98908216841.pdf
- https://site-1039390.mozfiles.com/files/1039390/2782653298.pdf
- https://cdn-cms.f-static.net/uploads/4365998/normal_5f8754eb445f1.pdf
- https://cdn-cms.f-static.net/uploads/4366350/normal_5f8714fec4854.pdf
- https://cdn-cms.f-static.net/uploads/4366017/normal_5f8707a09ea3a.pdf
- https://cdn-cms.f-static.net/uploads/4366351/normal_5f8724fd1d857.pdf
- https://uploads.strikinglycdn.com/files/fca0717a-3b63-4bba-b6bf-8909785ccbac/lexowokenazafu.pdf
- https://uploads.strikinglycdn.com/files/67f58ea4-1214-40c9-be17-f348d3f1f895/51789586882.pdf
- https://uploads.strikinglycdn.com/files/af3a05f9-ef56-4cf2-94cc-2567893e6f41/pozuxodigebaxo.pdf
- https://uploads.strikinglycdn.com/files/e91ddb60-dae4-4dd9-8af0-5d6667ab28b9/49868695637.pdf
- https://cdn.shopify.com/s/files/1/0496/1117/8151/files/zizet.pdf
- https://cdn.shopify.com/s/files/1/0429/9902/1717/files/kudixezetorupa.pdf
- https://cdn.shopify.com/s/files/1/0500/0370/6006/files/jagofawedodewile.pdf
- https://cdn.shopify.com/s/files/1/0432/6208/3232/files/spring_snow_yukio_mishima.pdf
- https://cdn.shopify.com/s/files/1/0492/0243/0118/files/52774366314.pdf
- https://remewizefo.weebly.com/uploads/1/3/1/8/131856163/jezowogabusot_dajuxax_peloxidinivolup_foxilabeleturak.pdf
- https://pigogokeda.weebly.com/uploads/1/3/1/8/131857695/xusavu_zerezujikewe_vikepegujojaluw_duvorafof.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ggtraff.ru
- site-1040280.mozfiles.com
- site-1039508.mozfiles.com
- site-1038770.mozfiles.com
- site-1041860.mozfiles.com
- site-1040036.mozfiles.com
- site-1039390.mozfiles.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- remewizefo.weebly.com
- pigogokeda.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report