SUSPICIOUS — lumitimuveni.pdf
SUSPICIOUS — lumitimuveni.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
94b5adcc3653a2b5349b4cb2679e01ef109a0b48787f545a9825fc0b0f7bf5e3 - SHA-1:
8b41338fa4cab6c8ce2d54bfed127a335e355257 - MD5:
7fe3f31718e1da316666b29649ef399b - ssdeep:
1536:FGFRpPqZEMRZGYCYpgUKS3NGYw9p075hnsHc3h32w:YFRpP2EvtYWUKS3Nnz/3 - TLSH:
T1BA339EF39493DD8D7687A743A8A7056A61C9C7887173EB90458C7B3CD57C2BE6E00A10 - Submitted as: lumitimuveni.pdf
- File type: pdf · Size: 49971 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=book%20of%20combos%20mh4u, https://cdn-cms.f-static.net/uploads/4366407/normal_5f874497eabe2.pdf, https://cdn-cms.f-static.net/uploads/4365549/normal_5f86f57c73987.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=book%20of%20combos%20mh4u
- https://cdn-cms.f-static.net/uploads/4366407/normal_5f874497eabe2.pdf
- https://cdn-cms.f-static.net/uploads/4365549/normal_5f86f57c73987.pdf
- https://cdn-cms.f-static.net/uploads/4365606/normal_5f870f268a02d.pdf
- https://cdn-cms.f-static.net/uploads/4372104/normal_5f8b43b43f8d3.pdf
- https://cdn-cms.f-static.net/uploads/4370319/normal_5f8cb60e678eb.pdf
- https://cdn.shopify.com/s/files/1/0482/1572/0093/files/rivers_and_roads_lyrics_genius.pdf
- https://cdn.shopify.com/s/files/1/0485/8354/0901/files/bobina_de_tesla_objetivos.pdf
- https://cdn.shopify.com/s/files/1/0486/2997/3157/files/level_of_analysis_in_research.pdf
- https://cdn.shopify.com/s/files/1/0430/1609/3849/files/rv_bumper_storage_rack.pdf
- https://cdn.shopify.com/s/files/1/0432/4353/6541/files/vitisef.pdf
- https://cdn.shopify.com/s/files/1/0481/3393/1175/files/29744631923.pdf
- https://cdn.shopify.com/s/files/1/0437/4318/2999/files/snowmobile_trailer_tires_18.5x8.5-8.pdf
- https://cdn.shopify.com/s/files/1/0438/4574/6838/files/nfl_fantasy_draft_guide_ppr.pdf
- https://cdn.shopify.com/s/files/1/0437/2352/2216/files/86376562299.pdf
- https://cdn.shopify.com/s/files/1/0481/3645/4307/files/zekugiwagi.pdf
- https://cdn-cms.f-static.net/uploads/4374196/normal_5f8a4406a57d3.pdf
- https://cdn-cms.f-static.net/uploads/4383929/normal_5f8c610233fe2.pdf
- https://cdn-cms.f-static.net/uploads/4369768/normal_5f88611245504.pdf
- https://cdn-cms.f-static.net/uploads/4365582/normal_5f8c66ba1e628.pdf
- https://cdn.shopify.com/s/files/1/0495/9204/1624/files/namuvimedezisawofone.pdf
- https://cdn.shopify.com/s/files/1/0488/4080/2469/files/fafegerobuzolepif.pdf
- https://cdn.shopify.com/s/files/1/0431/3782/6973/files/kaparokuvos.pdf
- https://cdn.shopify.com/s/files/1/0481/3884/6371/files/oxford_dictionary_picture.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report