SUSPICIOUS — jojul.pdf
SUSPICIOUS — jojul.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
45a7885498743f21a9b08cecf1129791b8e7cef1c0647c3cccf3ef50f5ec521b - SHA-1:
e2b997c25190c4fc62d9a722c64777456b57d68f - MD5:
c49c98a1cac6759823179f771471f152 - ssdeep:
768:qgGzpDapvF0Pv5OChtlP4NEu2bAA72zgnx6UNv+Xg9xCxjepUtgAq5jpdeGb/ZWQ:3GFupGPAChtlPlu8AA7ugUXg9xUYUOAK - TLSH:
T127328DF311A7DD4C768B9B47AEE710A9504AD78D6032A7A004893B2DD4BC6FD7E40A21 - Submitted as: jojul.pdf
- File type: pdf · Size: 47572 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=the%20mind, https://site-1037114.mozfiles.com/files/1037114/83839389558.pdf, https://site-1037081.mozfiles.com/files/1037081/lonomeripiburovitaru.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=the%20mind
- https://site-1037114.mozfiles.com/files/1037114/83839389558.pdf
- https://site-1037081.mozfiles.com/files/1037081/lonomeripiburovitaru.pdf
- https://site-1042279.mozfiles.com/files/1042279/76416355302.pdf
- https://site-1038700.mozfiles.com/files/1038700/88693825326.pdf
- https://cdn-cms.f-static.net/uploads/4366336/normal_5f8724956f270.pdf
- https://site-1040558.mozfiles.com/files/1040558/37827946349.pdf
- https://site-1038412.mozfiles.com/files/1038412/famafotitobuletoji.pdf
- https://site-1045364.mozfiles.com/files/1045364/mifisofazani.pdf
- https://site-1037019.mozfiles.com/files/1037019/forutidopoxav.pdf
- https://site-1038974.mozfiles.com/files/1038974/55595189833.pdf
- https://site-1040175.mozfiles.com/files/1040175/lasidekofobujoge.pdf
- https://site-1039460.mozfiles.com/files/1039460/84885805245.pdf
- https://site-1037207.mozfiles.com/files/1037207/14026490857.pdf
- https://site-1039487.mozfiles.com/files/1039487/xutegabekakewudakopaxukav.pdf
- https://site-1039906.mozfiles.com/files/1039906/wonizozonoset.pdf
- https://site-1042720.mozfiles.com/files/1042720/galadewopadif.pdf
- https://cdn-cms.f-static.net/uploads/4367007/normal_5f876af09870e.pdf
- https://cdn-cms.f-static.net/uploads/4367305/normal_5f8753044b2c6.pdf
- https://cdn-cms.f-static.net/uploads/4365539/normal_5f87685dc8295.pdf
- https://cdn-cms.f-static.net/uploads/4367650/normal_5f8768e20588b.pdf
- https://cdn-cms.f-static.net/uploads/4366389/normal_5f876d6901836.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ggtraff.ru
- site-1037114.mozfiles.com
- site-1037081.mozfiles.com
- site-1042279.mozfiles.com
- site-1038700.mozfiles.com
- cdn-cms.f-static.net
- site-1040558.mozfiles.com
- site-1038412.mozfiles.com
- site-1045364.mozfiles.com
- site-1037019.mozfiles.com
- site-1038974.mozfiles.com
- site-1040175.mozfiles.com
- site-1039460.mozfiles.com
- site-1037207.mozfiles.com
- site-1039487.mozfiles.com
- site-1039906.mozfiles.com
- site-1042720.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report