SUSPICIOUS — xijuzunatepesa.pdf
SUSPICIOUS — xijuzunatepesa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
33c991d2478f73beb36f53bd1d7863007fc7ec6e5310440fd3181eadb273135c - SHA-1:
94f3e8160a9bd392e595a048305171780920b5be - MD5:
d37ed692238a3380bf1cf36bde964be1 - ssdeep:
768:0gGzpDHpqPqmPn+RV/Kb3NR+Q+JxM7IWI/+Cxa2bKWzDhj6yHHP4q/e9gF3gBgZl:BGF7pqIBaGjvNfngq/e63l - TLSH:
T1B3328DF32093ED5C7A8B9B539DAB146A714EC38C6136E79445C8276DC0BC6AD7E20860 - Submitted as: xijuzunatepesa.pdf
- File type: pdf · Size: 45105 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/bfd75470-c9d0-40c2-a25a-1453f00534ec/31548053685.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=dilbar%20janiya%20o%20dilbar%20janiya%20mp3%20so, https://uploads.strikinglycdn.com/files/bfd75470-c9d0-40c2-a25a-1453f00534ec/31548053685.pdf, https://uploads.strikinglycdn.com/files/b58cf2c9-a740-492e-ba36-a42fc0ffdb7b/totarifikamem.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=dilbar%20janiya%20o%20dilbar%20janiya%20mp3%20so
- https://uploads.strikinglycdn.com/files/bfd75470-c9d0-40c2-a25a-1453f00534ec/31548053685.pdf
- https://uploads.strikinglycdn.com/files/b58cf2c9-a740-492e-ba36-a42fc0ffdb7b/totarifikamem.pdf
- https://uploads.strikinglycdn.com/files/2d82553e-9730-4115-8d66-eeaed6c815f2/22453951621.pdf
- https://uploads.strikinglycdn.com/files/f5741824-c249-4f9a-88b3-849ac2350eab/26660511102.pdf
- https://uploads.strikinglycdn.com/files/87b7e9b3-79ed-4bca-92db-94bb56f2de7d/fokunadome.pdf
- https://cdn.shopify.com/s/files/1/0432/8472/5926/files/61503797912.pdf
- https://cdn.shopify.com/s/files/1/0435/2045/8906/files/amx-13_dca_40.pdf
- https://cdn.shopify.com/s/files/1/0476/7934/0710/files/onn_tilting_tv_wall_mount_instructions_13-32.pdf
- https://cdn-cms.f-static.net/uploads/4366354/normal_5f87220fefc3c.pdf
- https://cdn-cms.f-static.net/uploads/4366031/normal_5f87148cd4bbe.pdf
- https://cdn-cms.f-static.net/uploads/4366341/normal_5f87568ad924b.pdf
- https://cdn-cms.f-static.net/uploads/4365642/normal_5f870c9be9686.pdf
- https://cdn-cms.f-static.net/uploads/4366321/normal_5f876cbfe75ec.pdf
- https://cdn-cms.f-static.net/uploads/4366316/normal_5f88041f2ae4a.pdf
- https://cdn-cms.f-static.net/uploads/4370073/normal_5f88275223220.pdf
- https://cdn-cms.f-static.net/uploads/4365620/normal_5f8743a56ad93.pdf
- https://cdn-cms.f-static.net/uploads/4366964/normal_5f876f75346ea.pdf
- https://site-1040575.mozfiles.com/files/1040575/mifobol.pdf
- https://site-1039668.mozfiles.com/files/1039668/dotukixodejawakomoli.pdf
- https://site-1039886.mozfiles.com/files/1039886/77700974577.pdf
- https://site-1042879.mozfiles.com/files/1042879/5171605673.pdf
- https://cdn-cms.f-static.net/uploads/4365594/normal_5f8718ac70953.pdf
- https://cdn-cms.f-static.net/uploads/4369174/normal_5f8844b8b8e64.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- cdn-cms.f-static.net
- site-1040575.mozfiles.com
- site-1039668.mozfiles.com
- site-1039886.mozfiles.com
- site-1042879.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report