SUSPICIOUS — jefixag_xomawala_zupef_wusofebokat.pdf

SUSPICIOUS — jefixag_xomawala_zupef_wusofebokat.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 35167fbc782f78cb571dc02df2d5a1df32cdc223643c9744808181c20553498c
• SHA-1: 690d8fc891ed6626b7b7e6f72b1f4d77a663db4d
• MD5: 7227e0e45f72a7c2a43687686609d5ba
• ssdeep: 768:FgGzpD3pI9dqe2QOhCC5OK2igpsf4HmQy:WGF7ze2QO8CcFiKS4HmQy
• TLSH: T116319EF351A7EC8C6ADA5F076EAB1488A087C78C7132A66008D8B67DC17C6FD6E50570
• Submitted as: jefixag_xomawala_zupef_wusofebokat.pdf
• File type: pdf · Size: 42196 bytes
• Verdict: suspicious (44/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/wb?keyword=clearing%20fractions%20pdf, https://uploads.strikinglycdn.com/files/40caf180-585a-47ab-843a-517a40d23c2a/gozopuvinarilajokafaxigu.pdf, https://uploads.strikinglycdn.com/files/5607f433-6fe5-463a-8750-0a2fd31f0969/tusigutowederenixise.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/wb?keyword=clearing%20fractions%20pdf
• https://s3.amazonaws.com/jedaxopopuko/7505546392.pdf
• https://uploads.strikinglycdn.com/files/40caf180-585a-47ab-843a-517a40d23c2a/gozopuvinarilajokafaxigu.pdf
• https://s3.amazonaws.com/zuxime/64911851616.pdf
• https://uploads.strikinglycdn.com/files/5607f433-6fe5-463a-8750-0a2fd31f0969/tusigutowederenixise.pdf
• https://s3.amazonaws.com/gidibesuxi/accounts_payable_clerk_interview_questions_and_answers.pdf
• https://s3.amazonaws.com/fejenijovekozu/23026657905.pdf
• https://uploads.strikinglycdn.com/files/66019282-a274-4368-bb21-5609cdbffc92/28979830134.pdf
• https://s3.amazonaws.com/bubodeliza/31723141427.pdf
• https://xoraxabaxid.weebly.com/uploads/1/3/2/6/132682630/gekugetuwexujosewumo.pdf
• https://s3.amazonaws.com/radaruropivoje/63019740488.pdf
• https://papunagaku.weebly.com/uploads/1/3/1/3/131384156/jebawuba_sorowujuwadidu.pdf
• https://s3.amazonaws.com/divexikav/finivuzuwevakevusolifez.pdf
• https://uploads.strikinglycdn.com/files/d138ace1-cef1-41d6-b5da-d4f136be328a/15623728604.pdf
• https://s3.amazonaws.com/libosokune/35369359769.pdf
• https://s3.amazonaws.com/fulomufimikim/nikon_action_binoculars_10x40.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• s3.amazonaws.com
• uploads.strikinglycdn.com
• xoraxabaxid.weebly.com
• papunagaku.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report