SUSPICIOUS — xumojewowidigi.pdf
SUSPICIOUS — xumojewowidigi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7ade5c65f0929f818855be6524e7e0ef1c6fc38c0b8b9ede5706c78c6814e684 - SHA-1:
761bff782d05db2d2605f5cd5c2c4d3382531c5c - MD5:
ded8377430aab046108548ad1291dd14 - ssdeep:
768:ogGzpDdzdeIDxGxm6ZSiKGV+G/TtOpzguzl0qvRBemqTT:lGFZlWXKG8G/TtAzgw0qumqTT - TLSH:
T1DE316CF31093EE4D7A8B6F03AAE71169614AD78C7136E79054C93B2CD0BC6ED2E04961 - Submitted as: xumojewowidigi.pdf
- File type: pdf · Size: 42846 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/5ab57b0c-7b7c-40c1-95ca-83323a8dbe96/6914695322.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=seagull%20book%20of%20stories%20pdf, https://uploads.strikinglycdn.com/files/c152631d-b5e1-4710-a0f6-d5e1983d97ca/pictures_of_teacup_pomeranian.pdf, https://uploads.strikinglycdn.com/files/01cfbced-d743-4add-aa46-c5b9f7eb64ff/fetobuzidivuv.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=seagull%20book%20of%20stories%20pdf
- https://uploads.strikinglycdn.com/files/c152631d-b5e1-4710-a0f6-d5e1983d97ca/pictures_of_teacup_pomeranian.pdf
- https://uploads.strikinglycdn.com/files/01cfbced-d743-4add-aa46-c5b9f7eb64ff/fetobuzidivuv.pdf
- https://uploads.strikinglycdn.com/files/96e0e279-7574-45a0-a8bc-50e41b56f5ab/44039814529.pdf
- https://uploads.strikinglycdn.com/files/5ab57b0c-7b7c-40c1-95ca-83323a8dbe96/6914695322.pdf
- https://uploads.strikinglycdn.com/files/a2ab75ee-df3d-4f83-915d-64762eeaf191/89392724303.pdf
- https://uploads.strikinglycdn.com/files/c51ffc81-e8df-4253-add0-394bc0ae95a7/80180557160.pdf
- https://uploads.strikinglycdn.com/files/3adc7082-d90b-4769-af73-31e6b5636542/tonibadexute.pdf
- https://uploads.strikinglycdn.com/files/5dd4596c-def3-4bff-ac10-8fb912dde69c/anlar_kimin_iin_alyor_yorumlar.pdf
- https://uploads.strikinglycdn.com/files/4a38813f-2439-4aec-a382-d27718ddce3d/37700683325.pdf
- https://cdn-cms.f-static.net/uploads/4369788/normal_5f8bc91daa63c.pdf
- https://cdn-cms.f-static.net/uploads/4370288/normal_5f8f4f27e0d36.pdf
- https://cdn-cms.f-static.net/uploads/4387242/normal_5f922c384ed0d.pdf
- https://uploads.strikinglycdn.com/files/5a4d624e-a6c3-41ef-97a1-3eeeb902cc85/1775605046.pdf
- https://uploads.strikinglycdn.com/files/840d0e14-bfad-49f5-bfdf-e6ab2026019b/semefoki.pdf
- https://uploads.strikinglycdn.com/files/3f38a89e-2081-44a1-b7ea-394ae662aaf0/bazifevuke.pdf
- https://uploads.strikinglycdn.com/files/83f03a5d-a022-416b-840d-060f91eab3e5/44375429071.pdf
- https://cdn.shopify.com/s/files/1/0503/8309/3910/files/standard_report_writing_format.pdf
- https://cdn.shopify.com/s/files/1/0497/3897/3345/files/iso_14001_training.pdf
- https://s3.amazonaws.com/tetazino/spanish_books_for_beginners_free.pdf
- https://s3.amazonaws.com/wunojipu/zonapufom.pdf
- https://s3.amazonaws.com/lixasifasi/diploma_electrical_and_electronics_engineering_books.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- cdn.shopify.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report