SUSPICIOUS — bovajilamivakota.pdf
SUSPICIOUS — bovajilamivakota.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
5887e4f9f2106a103179bde17166a76316eaf3b0b76a0e294a084d3d59774189 - SHA-1:
48dfd15e10243a2aab7461e28c53bdb137998392 - MD5:
7754b59ca1e486e7ae385909fcb7600e - ssdeep:
768:ngGzpDDp86QacjwyhX6085ACnRATsP6kB7tYQay9XMebioCcYXOIknl:gGFXp0crPa4MSiofvIknl - TLSH:
T1A3305BF310A7ED8C7A8B5F53ADA7169D9589C3886223E3900488272CD4BCAED7F11951 - Submitted as: bovajilamivakota.pdf
- File type: pdf · Size: 35883 bytes
- Verdict: suspicious (35/100)
Detections (1 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=sapred%20institucion%20educativa%20san%20lui, https://cdn-cms.f-static.net/uploads/4374009/normal_5f8e2c63cd2ce.pdf, https://cdn-cms.f-static.net/uploads/4367631/normal_5f8e0be39a016.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=sapred%20institucion%20educativa%20san%20lui
- https://cdn-cms.f-static.net/uploads/4374009/normal_5f8e2c63cd2ce.pdf
- https://cdn-cms.f-static.net/uploads/4367631/normal_5f8e0be39a016.pdf
- https://cdn-cms.f-static.net/uploads/4372361/normal_5f8e22c5e4d2d.pdf
- https://cdn-cms.f-static.net/uploads/4381738/normal_5f8e001b96587.pdf
- https://cdn.shopify.com/s/files/1/0476/7481/8726/files/932227526.pdf
- https://cdn.shopify.com/s/files/1/0427/7728/0671/files/cell_cycle_chromosomes_mitosis_and_meiosis_test_study_guide.pdf
- https://cdn.shopify.com/s/files/1/0462/0232/3094/files/no_paso_nada_antonio_skarmeta_summary.pdf
- https://cdn.shopify.com/s/files/1/0437/5887/8872/files/12236896285.pdf
- https://cdn.shopify.com/s/files/1/0430/8339/9329/files/powers_of_ten_worksheet.pdf
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/kedoxezezaj-temolej-zunemalavorun-mutelokowomimi.pdf
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/xewuj.pdf
- https://lusukukupesakub.weebly.com/uploads/1/3/0/8/130815137/lufitalil.pdf
- https://luwobidope.weebly.com/uploads/1/3/0/8/130814225/jekov_kulilosu_gemawuxememesud.pdf
- https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/56c4742ffb2635.pdf
- https://cdn-cms.f-static.net/uploads/4366969/normal_5f88b93e2decb.pdf
- https://cdn-cms.f-static.net/uploads/4366659/normal_5f8c65d738cd4.pdf
- https://cdn-cms.f-static.net/uploads/4366381/normal_5f88aeaf07ba6.pdf
- https://cdn-cms.f-static.net/uploads/4367290/normal_5f87437b42891.pdf
- https://cdn-cms.f-static.net/uploads/4377679/normal_5f8c0a2b14155.pdf
- https://cdn-cms.f-static.net/uploads/4371258/normal_5f89095782c63.pdf
- https://cdn-cms.f-static.net/uploads/4365594/normal_5f8db4892269f.pdf
- https://cdn-cms.f-static.net/uploads/4374177/normal_5f8e05952481e.pdf
- https://cdn-cms.f-static.net/uploads/4366666/normal_5f8787887b564.pdf
- https://cdn-cms.f-static.net/uploads/4366004/normal_5f870157b2714.pdf
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- guwomenod.weebly.com
- bedizegoresupa.weebly.com
- lusukukupesakub.weebly.com
- luwobidope.weebly.com
- wepugimi.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report