SUSPICIOUS — famowimamomebam.pdf
SUSPICIOUS — famowimamomebam.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100), attributed to the REvil family. 3 of 50 detection engines flagged it.
Identification
- SHA-256:
475424a9b78775e617d27b73402aae03ed2df67298534d37485c77a8f9cb420b - SHA-1:
7c596e8bc22836b92dbc44ae6961597acbc3ce60 - MD5:
f74ebbcdee3986f248fcc8e44a663dad - ssdeep:
768:E+gGzpDfeNetSQKrKIC1+SPpK2lzXEsQohtvbuFh+Rb+i123VQmHUk/z1D2x5WTm:QGFLeKB5zXMoUwRbX8ZHLh2XWTm - TLSH:
T1FA34B0F7509BDD4CBA865B13AAAB1099208AD7C86132C6B005C8B77CC57C6EDFE10A50 - Submitted as: famowimamomebam.pdf
- File type: pdf · Size: 57268 bytes
- Verdict: suspicious (58/100) · Family: REvil
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule
ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://cctraff.ru/wb?keyword=tableau%20data%20visualization%20cookbook%20pdf%20download, https://cdn.shopify.com/s/files/1/0479/2670/6343/files/reframing_organizations_6th_edition_free.pdf, https://cdn.shopify.com/s/files/1/0433/9816/8743/files/wells_technical_institute_balance_sheet.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=tableau%20data%20visualization%20cookbook%20pdf%20download
- https://cdn.shopify.com/s/files/1/0479/2670/6343/files/reframing_organizations_6th_edition_free.pdf
- https://cdn.shopify.com/s/files/1/0433/9816/8743/files/wells_technical_institute_balance_sheet.pdf
- https://cdn.shopify.com/s/files/1/0501/8697/7441/files/breville_avance_toaster_manual.pdf
- https://cdn.shopify.com/s/files/1/0497/5699/5745/files/25900146846.pdf
- https://cdn.shopify.com/s/files/1/0483/5940/7765/files/types_of_multiprocessor_operating_system.pdf
- https://cdn.shopify.com/s/files/1/0483/4685/7635/files/32349195308.pdf
- https://s3.amazonaws.com/regegozumekoza/algorithms_geeksforgeeks.pdf
- https://s3.amazonaws.com/memul/sometimes_seeing_is_believing_lab_manual.pdf
- https://tudekazesabi.weebly.com/uploads/1/3/4/3/134367585/8324133.pdf
- https://xavoxoxuda.weebly.com/uploads/1/3/1/3/131379246/b1bb92aa4.pdf
- https://megadezatesaram.weebly.com/uploads/1/3/0/7/130776649/wedazugibekud-perapivamopep.pdf
- https://zutovabofilosu.weebly.com/uploads/1/3/4/3/134333865/zamorode-rewag-volojej-javefuzatelibum.pdf
- https://sejejuno.weebly.com/uploads/1/3/4/4/134447194/widilusow-mogitaser.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/dekefomivupe-kovak-talajonipa-fedebiraroz.pdf
- https://naxedomabaxa.weebly.com/uploads/1/3/1/6/131606472/nasodetu-vafafad.pdf
- https://vuzevarezevarot.weebly.com/uploads/1/3/0/7/130740461/gaxulikotativo.pdf
- https://gomemetunugup.weebly.com/uploads/1/3/2/7/132712315/6701395.pdf
- https://kokexofagisukop.weebly.com/uploads/1/3/2/7/132710589/kabojo-rutovumeme-zemogo.pdf
- https://boguvetasitob.weebly.com/uploads/1/3/1/3/131380850/lebuwotafibumo_numenuzewomu_rawaponakuku_defumeteduz.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- cctraff.ru
- cdn.shopify.com
- s3.amazonaws.com
- tudekazesabi.weebly.com
- xavoxoxuda.weebly.com
- megadezatesaram.weebly.com
- zutovabofilosu.weebly.com
- sejejuno.weebly.com
- zoxuzuxebexot.weebly.com
- naxedomabaxa.weebly.com
- vuzevarezevarot.weebly.com
- gomemetunugup.weebly.com
- kokexofagisukop.weebly.com
- boguvetasitob.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
More REvil samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report