SUSPICIOUS — susamujakez.pdf

SUSPICIOUS — susamujakez.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 6cfe7f7afd903938315bdb3b8755689faf1c4ce3475e5d342c4dbe1b3962f33e
• SHA-1: 473c1bb6054c508a06808c7fe6f2511eeebb0eab
• MD5: dca209ba1d25aaa5141bcf60f12f5827
• ssdeep: 384:XsFlS3K6XgKV7cAgdOpW+0qE3Z7KoZpIFaF9M7l2Dt5WYm3Pe7oiFnAf09Q5CUSu:TgGzpDrEEEI7l2DHW73P+xe7kMVqMHp
• TLSH: T174309DF74167DC8C7ACBEF036EA628592485E28DA033939419D8363DC4BC7AC6E51970
• Submitted as: susamujakez.pdf
• File type: pdf · Size: 36391 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/wb?keyword=texas%20a%20and%20m%20greek%20life, https://vekaluledezo.weebly.com/uploads/1/3/4/2/134235689/dusegi.pdf, https://sarutofujatazix.weebly.com/uploads/1/3/4/5/134584212/lepuzijiled-domapuge.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/wb?keyword=texas%20a%20and%20m%20greek%20life
• https://s3.amazonaws.com/vawoginele/geforce_experience_overlay.pdf
• https://vekaluledezo.weebly.com/uploads/1/3/4/2/134235689/dusegi.pdf
• https://sarutofujatazix.weebly.com/uploads/1/3/4/5/134584212/lepuzijiled-domapuge.pdf
• https://tipiridevozono.weebly.com/uploads/1/3/4/3/134349557/1266094.pdf
• https://s3.amazonaws.com/zuxadol/battlefront_iii_legacy_mod.pdf
• https://risimapi.weebly.com/uploads/1/3/4/3/134321435/2284e468d.pdf
• https://s3.amazonaws.com/jedaxopopuko/123812718.pdf
• https://s3.amazonaws.com/faluzotixupi/potivefotofetenove.pdf
• https://monubigikupo.weebly.com/uploads/1/3/4/4/134493781/worose.pdf
• https://zafojepomekosax.weebly.com/uploads/1/3/4/3/134352399/dda9c8fd3171e0.pdf
• https://s3.amazonaws.com/zetare/kleiner_maken_van_bestand.pdf
• https://zegasaxum.files.wordpress.com/2020/11/33719047116.pdf
• https://s3.amazonaws.com/dukajevo/lamewupefipedapudax.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• s3.amazonaws.com
• vekaluledezo.weebly.com
• sarutofujatazix.weebly.com
• tipiridevozono.weebly.com
• risimapi.weebly.com
• monubigikupo.weebly.com
• zafojepomekosax.weebly.com
• zegasaxum.files.wordpress.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report