SUSPICIOUS — pejewidomi.pdf
SUSPICIOUS — pejewidomi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
98841cc5a47663c8452054ff05a3f2cf4ccbcfac67f7fe463444e814e27cfc20 - SHA-1:
88aa75163577d8323d7f5ef2f62c022738274070 - MD5:
9dc7d1c6d29e4274a76090d4d81a6549 - ssdeep:
768:RgGzpD2eUPfSahuuUqGby/31aOAXGjUSB8EWLTUf6soFdbV5H6qHoaq0+aTYkeJn:iGFaeUMqGoZqIa8akkeJKSRdTr - TLSH:
T14D336CF300B7DD4D7A87DB03A9AE382C5449D78C6132AAA45988776DC47C77E2F50920 - Submitted as: pejewidomi.pdf
- File type: pdf · Size: 48905 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=lubricating%20oil%20grade%20pdf, https://cdn.shopify.com/s/files/1/0437/8987/7405/files/black_diamond_tents_australia.pdf, https://cdn.shopify.com/s/files/1/0440/7531/9448/files/karzan_dictionary_mod_apk.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=lubricating%20oil%20grade%20pdf
- https://cdn.shopify.com/s/files/1/0433/7808/1959/files/faxasolovupozamulude.pdf
- https://cdn.shopify.com/s/files/1/0437/8987/7405/files/black_diamond_tents_australia.pdf
- https://cdn.shopify.com/s/files/1/0440/7531/9448/files/karzan_dictionary_mod_apk.pdf
- https://cdn.shopify.com/s/files/1/0497/9359/7601/files/android_x86_download_6.0.pdf
- https://cdn.shopify.com/s/files/1/0481/7482/5621/files/72325744763.pdf
- https://cdn.shopify.com/s/files/1/0434/8307/0629/files/one_step_equations_worksheet_word_problems.pdf
- https://cdn.shopify.com/s/files/1/0503/2417/7093/files/word_e_evirme_program.pdf
- https://cdn.shopify.com/s/files/1/0467/9837/3013/files/litebakedagimipafi.pdf
- https://cdn.shopify.com/s/files/1/0498/8197/2888/files/75756783775.pdf
- https://cdn.shopify.com/s/files/1/0493/8842/1282/files/exercises_simple_past_vs_present_perfect.pdf
- https://cdn-cms.f-static.net/uploads/4388815/normal_5f8e758b30f80.pdf
- https://cdn-cms.f-static.net/uploads/4367273/normal_5f8d14e197cac.pdf
- https://cdn-cms.f-static.net/uploads/4369328/normal_5f92432215e3c.pdf
- https://cdn-cms.f-static.net/uploads/4367927/normal_5f8d0800c45a6.pdf
- https://cdn-cms.f-static.net/uploads/4375352/normal_5f8f0677d2461.pdf
- https://s3.amazonaws.com/gofilafixu/wejuvitopatavesobozesi.pdf
- https://s3.amazonaws.com/wixamupelinere/mevipevizexav.pdf
- https://s3.amazonaws.com/dorulusof/golekabe.pdf
- https://s3.amazonaws.com/memul/71274303360.pdf
- https://cdn-cms.f-static.net/uploads/4367656/normal_5f8aa950a13af.pdf
- https://cdn-cms.f-static.net/uploads/4390071/normal_5f9236f67674d.pdf
- https://cdn-cms.f-static.net/uploads/4369768/normal_5f87ffd16bd6e.pdf
- https://cdn-cms.f-static.net/uploads/4365586/normal_5f8708bb6eb0e.pdf
- https://cdn-cms.f-static.net/uploads/4389384/normal_5f90a74759578.pdf
Embedded domains
- cctraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report