SUSPICIOUS — wexevoluweve.pdf

SUSPICIOUS — wexevoluweve.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 6c27267957a55b5b8b7207140690df8bd342b16a881fdf4cd6b37b470b689368
• SHA-1: 3fa61bf363387f822c2484e9d0995974caac6811
• MD5: 2a387e16ee2669845edbdc8a652e92ea
• ssdeep: 768:dgGzpD17z8ohPK0E+YHkyrpTf9Z86NDN7gjbZ2cT33lFtqyLbY5bW+xKxGk3JViu:eGFh74386Np0jlf33syLEbW0KxzJViGf
• TLSH: T1D4329EF351A7DD8C3A8BAF0369E6105C614AC78CB12357645589BB7CC07C6FDAE01921
• Submitted as: wexevoluweve.pdf
• File type: pdf · Size: 47281 bytes
• Verdict: suspicious (44/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://traffking.ru/wb?keyword=fruits%20basket%20shigure, http://purl.org/dc/elements/1.1/ - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffking.ru/wb?keyword=fruits%20basket%20shigure
• https://s3.amazonaws.com/bubeto/11522032302.pdf
• https://rabewinu.files.wordpress.com/2020/11/vukoro.pdf
• https://s3.amazonaws.com/gazitif/46580619699.pdf
• https://nevosaxovib.files.wordpress.com/2020/11/fizimobaruweboratiweti.pdf
• https://s3.amazonaws.com/xeroguru/free_movies_2019_apk_download.pdf
• https://losorul.files.wordpress.com/2020/11/76295982183.pdf
• https://diguzijemo.files.wordpress.com/2020/11/conversation_with_mani_ratnam_fr.pdf
• https://zusepofofone.files.wordpress.com/2020/11/vowiriso.pdf
• https://mufepokupi.files.wordpress.com/2020/11/purunagegutawesogirifug.pdf
• https://rotadenig.files.wordpress.com/2020/11/82236523173.pdf
• https://matodokabaj.files.wordpress.com/2020/11/5925634160.pdf
• https://s3.amazonaws.com/defipedibe/loxepugututalodovaseruj.pdf
• https://fevuxiwop.files.wordpress.com/2020/11/76253438202.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffking.ru
• s3.amazonaws.com
• rabewinu.files.wordpress.com
• nevosaxovib.files.wordpress.com
• losorul.files.wordpress.com
• diguzijemo.files.wordpress.com
• zusepofofone.files.wordpress.com
• mufepokupi.files.wordpress.com
• rotadenig.files.wordpress.com
• matodokabaj.files.wordpress.com
• fevuxiwop.files.wordpress.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report