SUSPICIOUS — tamukudi.pdf
SUSPICIOUS — tamukudi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
74119fb41496a6d6006f3cdce7519886ffe49930184bc42008dc38e37bed76bd - SHA-1:
cf1e2848814c2d4851c3fe27e82bad25498b95d6 - MD5:
3a8f07a0762b0bc6e02d3d484eb7d596 - ssdeep:
768:3gGzpDZpP7m02bDACC2g8WD+UkJQRYpkzySuAnlyder1PT8o6XSTj:QGFtpN+UkJrWzySugydeNIo6yj - TLSH:
T101327BF34097DE8D7ACF5B476EAB21A9608AD2897132D69009D8772CC47C6ED7F00960 - Submitted as: tamukudi.pdf
- File type: pdf · Size: 44962 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=fotokopi%20makinesini%20kim%20icat%20etti, https://cdn.shopify.com/s/files/1/0430/7222/5442/files/tractor_supply_lawn_mower_battery.pdf, https://cdn.shopify.com/s/files/1/0483/1540/0355/files/psa_didnt_deliver_my_birth_certificate.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=fotokopi%20makinesini%20kim%20icat%20etti
- https://cdn.shopify.com/s/files/1/0430/7222/5442/files/tractor_supply_lawn_mower_battery.pdf
- https://cdn.shopify.com/s/files/1/0483/1540/0355/files/psa_didnt_deliver_my_birth_certificate.pdf
- https://cdn.shopify.com/s/files/1/0503/0307/4469/files/absorption_reflection_and_refraction_of_light_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0268/8116/3435/files/selfie_stick_android_app.pdf
- https://cdn.shopify.com/s/files/1/0497/3749/8778/files/hoping_and_hopping.pdf
- https://cdn-cms.f-static.net/uploads/4368497/normal_5f87df182265d.pdf
- https://cdn-cms.f-static.net/uploads/4366408/normal_5f87336a6aa27.pdf
- https://site-1039924.mozfiles.com/files/1039924/zarud.pdf
- https://site-1038363.mozfiles.com/files/1038363/98053407366.pdf
- https://site-1038780.mozfiles.com/files/1038780/7051268596.pdf
- https://site-1041395.mozfiles.com/files/1041395/20239501219.pdf
- https://site-1036699.mozfiles.com/files/1036699/vurefibomagokevodutojo.pdf
- https://uploads.strikinglycdn.com/files/55d3636a-cdd3-46c9-b70c-96f54bf29797/93284282780.pdf
- https://uploads.strikinglycdn.com/files/d58c2267-9743-4e78-a941-c33712967bc2/wepesozuduxibexorolutato.pdf
- https://uploads.strikinglycdn.com/files/fd004585-67fc-4be1-9102-588beba44cf7/95183253055.pdf
- https://cdn.shopify.com/s/files/1/0434/6131/2664/files/avatar_arena_2.pdf
- https://cdn.shopify.com/s/files/1/0430/1484/8671/files/92076948502.pdf
- https://site-1040170.mozfiles.com/files/1040170/xonatowamezajokuvamadafi.pdf
- https://site-1048515.mozfiles.com/files/1048515/ragakaxidasupiref.pdf
- https://site-1041860.mozfiles.com/files/1041860/12308710139.pdf
- https://site-1036737.mozfiles.com/files/1036737/ruwas.pdf
- https://site-1036697.mozfiles.com/files/1036697/dizaleze.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- site-1039924.mozfiles.com
- site-1038363.mozfiles.com
- site-1038780.mozfiles.com
- site-1041395.mozfiles.com
- site-1036699.mozfiles.com
- uploads.strikinglycdn.com
- site-1040170.mozfiles.com
- site-1048515.mozfiles.com
- site-1041860.mozfiles.com
- site-1036737.mozfiles.com
- site-1036697.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report