SUSPICIOUS — mobepejusixozidiza.pdf
SUSPICIOUS — mobepejusixozidiza.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
425cc40cd0270ef96f116f9ccef90142bd525e6907798d72c70e1ee3f55530ae - SHA-1:
baa0171296453ef85ce7b3f192b3cb47c26d3728 - MD5:
00a46e549bba86f68c680b9071055c61 - ssdeep:
1536:6GFGeSKsslNpbCe0KjzzSftKtit99dJhCkgYxiZCLH4g:jFGeSKlNKKjvSt9rJQkPt - TLSH:
T122359EF31197ED4D778F6F07ADB600A9A18AC7492132ABE01488672CD87C9FD6F11A11 - Submitted as: mobepejusixozidiza.pdf
- File type: pdf · Size: 59735 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/strik?keyword=interagency+guidelines+establishing+information+security+standards+ncua, https://cdn-cms.f-static.net/uploads/4369508/normal_5f87c8a609abd.pdf, https://cdn-cms.f-static.net/uploads/4369150/normal_5f88c7f13f741.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/strik?keyword=interagency+guidelines+establishing+information+security+standards+ncua
- https://cdn-cms.f-static.net/uploads/4369508/normal_5f87c8a609abd.pdf
- https://cdn-cms.f-static.net/uploads/4369150/normal_5f88c7f13f741.pdf
- https://cdn-cms.f-static.net/uploads/4368497/normal_5f88bf9967fba.pdf
- https://cdn-cms.f-static.net/uploads/4368998/normal_5f87e190bd01a.pdf
- https://cdn-cms.f-static.net/uploads/4366630/normal_5f875f17d763c.pdf
- https://cdn-cms.f-static.net/uploads/4371244/normal_5f88caf800ef8.pdf
- https://cdn-cms.f-static.net/uploads/4368238/normal_5f88a20d3b75c.pdf
- https://cdn-cms.f-static.net/uploads/4367627/normal_5f88f0f727189.pdf
- https://cdn-cms.f-static.net/uploads/4372371/normal_5f88828d7f0d5.pdf
- https://site-1037916.mozfiles.com/files/1037916/57216953878.pdf
- https://site-1036835.mozfiles.com/files/1036835/jomupekibebotepemine.pdf
- https://site-1036737.mozfiles.com/files/1036737/walefuxoval.pdf
- https://site-1042841.mozfiles.com/files/1042841/73395535978.pdf
- https://cdn-cms.f-static.net/uploads/4366952/normal_5f88ccf47fe00.pdf
- https://cdn-cms.f-static.net/uploads/4366660/normal_5f877e3fb3d2f.pdf
- https://cdn-cms.f-static.net/uploads/4367297/normal_5f8749cd0ad9c.pdf
- https://cdn-cms.f-static.net/uploads/4365584/normal_5f8708e0d4d02.pdf
- https://cdn-cms.f-static.net/uploads/4371790/normal_5f88b0f9221f3.pdf
- https://site-1036696.mozfiles.com/files/1036696/53432409673.pdf
- https://site-1036742.mozfiles.com/files/1036742/govitizipelidatabezowe.pdf
- https://site-1036820.mozfiles.com/files/1036820/dizulazikixajuvamamenidiz.pdf
- https://site-1038650.mozfiles.com/files/1038650/56287258360.pdf
- https://site-1043446.mozfiles.com/files/1043446/14795601334.pdf
- https://site-1039500.mozfiles.com/files/1039500/ripubuj.pdf
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- site-1037916.mozfiles.com
- site-1036835.mozfiles.com
- site-1036737.mozfiles.com
- site-1042841.mozfiles.com
- site-1036696.mozfiles.com
- site-1036742.mozfiles.com
- site-1036820.mozfiles.com
- site-1038650.mozfiles.com
- site-1043446.mozfiles.com
- site-1039500.mozfiles.com
- site-1042548.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report