SUSPICIOUS — nirexupinamimegefij.pdf
SUSPICIOUS — nirexupinamimegefij.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
4e3e54a999797a199b37b0cbcd7ef2fb507091a6c8b1e4a37ed02cfbd28ab822 - SHA-1:
7733814952b633e6c8ce43b3cfca4bb0e3e7b49a - MD5:
dfb404c8ed220dce867bfefcc5ef17cc - ssdeep:
1536:ZGFwpRhM8MiKmGohFsf8qAWZlRFU6mcdEsmB:sFwptM8hS8qA+DFU65dEX - TLSH:
T13236AEF350A3EE8CBA8FA7076DFA20996149C38C7266A790444C772CD57CAAC7E10650 - Submitted as: nirexupinamimegefij.pdf
- File type: pdf · Size: 64062 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=god%20of%20war%20ascension%20walkthrough, https://uploads.strikinglycdn.com/files/0fa9a3bf-47e0-4f5f-ad41-b07f38d7fe75/60906827573.pdf, https://uploads.strikinglycdn.com/files/71cc2487-723b-433a-8bfe-5772ccfea574/xuzofoleruwiv.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=god%20of%20war%20ascension%20walkthrough
- https://uploads.strikinglycdn.com/files/0fa9a3bf-47e0-4f5f-ad41-b07f38d7fe75/60906827573.pdf
- https://uploads.strikinglycdn.com/files/71cc2487-723b-433a-8bfe-5772ccfea574/xuzofoleruwiv.pdf
- https://uploads.strikinglycdn.com/files/6deb46b2-842f-470b-8443-113c5c2cf29d/sevowalokara.pdf
- https://uploads.strikinglycdn.com/files/fb402319-93a4-459f-9833-c1d3a1bcfb80/xezazatepulavisu.pdf
- https://site-1038744.mozfiles.com/files/1038744/mabibegebezulaxi.pdf
- https://site-1038395.mozfiles.com/files/1038395/dewizufozapabavi.pdf
- https://site-1043335.mozfiles.com/files/1043335/xezogixevibujub.pdf
- https://site-1040512.mozfiles.com/files/1040512/acrobat_reader_android_apk_download.pdf
- https://site-1040559.mozfiles.com/files/1040559/84100374501.pdf
- https://uploads.strikinglycdn.com/files/48ea425f-5a61-41a1-8587-14af0098b05d/farivovisedijesobak.pdf
- https://uploads.strikinglycdn.com/files/7e3be731-d2de-4922-b5d2-220bbd9594bf/lilolov.pdf
- https://uploads.strikinglycdn.com/files/0284f237-34d4-4b5e-8fb7-ab6f16f3e88a/11508431240.pdf
- https://uploads.strikinglycdn.com/files/8cce549d-001f-46e3-8173-65f13783f16c/robidodalebevi.pdf
- https://uploads.strikinglycdn.com/files/a3b302c4-ed0e-4ea2-98fe-7c16484a0c74/61370598931.pdf
- https://cdn-cms.f-static.net/uploads/4366050/normal_5f87762075824.pdf
- https://cdn-cms.f-static.net/uploads/4366024/normal_5f8703f0eefc7.pdf
- https://site-1039175.mozfiles.com/files/1039175/tobiserugakapa.pdf
- https://site-1040896.mozfiles.com/files/1040896/2175376389.pdf
- https://site-1040286.mozfiles.com/files/1040286/wugukemolitakupewadofuke.pdf
- https://site-1043975.mozfiles.com/files/1043975/86155766614.pdf
- https://site-1036996.mozfiles.com/files/1036996/lizuninatunix.pdf
- https://site-1042840.mozfiles.com/files/1042840/megukubijoguza.pdf
- https://site-1042286.mozfiles.com/files/1042286/vajusi.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- site-1038744.mozfiles.com
- site-1038395.mozfiles.com
- site-1043335.mozfiles.com
- site-1040512.mozfiles.com
- site-1040559.mozfiles.com
- cdn-cms.f-static.net
- site-1039175.mozfiles.com
- site-1040896.mozfiles.com
- site-1040286.mozfiles.com
- site-1043975.mozfiles.com
- site-1036996.mozfiles.com
- site-1042840.mozfiles.com
- site-1042286.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report