SUSPICIOUS — zujonimokutot_wuponumuza_nowibove_pekajazip.pdf
SUSPICIOUS — zujonimokutot_wuponumuza_nowibove_pekajazip.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
802cb8553a94191679b288b22cf76532e56eedf02f3ed4947f4527e74f40f3e0 - SHA-1:
2e722106760cea95cb2dee8027481161970dfeca - MD5:
8fa3565da06dcb13d63f054af71b292b - ssdeep:
384:cpfvXG6CRgG6PInpgsGJ1tJ+abPdQZ0I/53tR91LoTqyH6CUSI7CuzMEfZ6/tnG/:+H2651aqnhESP78k9anCxJaazs - TLSH:
T1302C4AF35057DD8CBBCBAB236AAB5559244A838C6133DB704449BB2CC57C6BD2F90920 - Submitted as: zujonimokutot_wuponumuza_nowibove_pekajazip.pdf
- File type: pdf · Size: 26219 bytes
- Verdict: suspicious (35/100)
Detections (1 of 50 engines)
- Microsoft Defender: Trojan:PDF/Phish.HAG!MTB
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://trafftec.ru/wb?keyword=donald%20davison%20plattsburgh, https://cdn-cms.f-static.net/uploads/4374374/normal_5fa1142ef40e6.pdf, https://cdn-cms.f-static.net/uploads/4377403/normal_5f8ce470b756d.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://trafftec.ru/wb?keyword=donald%20davison%20plattsburgh
- https://s3.amazonaws.com/susopuzupure/fifa_ballon_d_or_2015_votes.pdf
- https://cdn-cms.f-static.net/uploads/4374374/normal_5fa1142ef40e6.pdf
- https://cdn-cms.f-static.net/uploads/4377403/normal_5f8ce470b756d.pdf
- https://cdn-cms.f-static.net/uploads/4403684/normal_5f957dde50ee1.pdf
- https://cdn-cms.f-static.net/uploads/4388815/normal_5fa807c698741.pdf
- https://kusumuwuwudes.weebly.com/uploads/1/3/4/3/134338751/12ee0.pdf
- https://cdn-cms.f-static.net/uploads/4418747/normal_5f9ca547e24da.pdf
- https://cdn-cms.f-static.net/uploads/4444378/normal_5fa1ba94be623.pdf
- https://cdn-cms.f-static.net/uploads/4415308/normal_5fa891731f794.pdf
- https://cdn-cms.f-static.net/uploads/4369626/normal_5f8d15191e818.pdf
- https://xubikorapaja.weebly.com/uploads/1/3/4/3/134335605/036cb6ff.pdf
- https://s3.amazonaws.com/ninazarila/2017_hyundai_accent_manual.pdf
- https://cdn-cms.f-static.net/uploads/4451574/normal_5fa91de3797ed.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- trafftec.ru
- s3.amazonaws.com
- cdn-cms.f-static.net
- kusumuwuwudes.weebly.com
- xubikorapaja.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report