SUSPICIOUS — jajetojomigunataxor.pdf
SUSPICIOUS — jajetojomigunataxor.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
98ad30e7726bf0a3e94034c846646e6128184604525b671c90375bcd848c7f5a - SHA-1:
4787e98d88e4dac1f1b36ffe0f54bb1875838533 - MD5:
f1078393642891995b7e59de5a5efcc6 - ssdeep:
768:wgGzpDXp1ieHIbQFRYpOpZMqlYTF16G80J5OJHlYQpLgIokK2PxBTHV+G01o:dGFbp10BxRfKHlYQpkIc2551+G01o - TLSH:
T107319DF324EBEC4C7A8B9B537CA71966258AC28872369620058C7B2CD5BC6BD3F11511 - Submitted as: jajetojomigunataxor.pdf
- File type: pdf · Size: 42537 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=convection%20currents%20in%20the%20air%20worksheet, https://cdn.shopify.com/s/files/1/0501/9844/6231/files/acuerdo_basilea_iii.pdf, https://cdn.shopify.com/s/files/1/0501/4061/0753/files/kasetizuzetub.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=convection%20currents%20in%20the%20air%20worksheet
- https://cdn.shopify.com/s/files/1/0501/9844/6231/files/acuerdo_basilea_iii.pdf
- https://cdn.shopify.com/s/files/1/0501/4061/0753/files/kasetizuzetub.pdf
- https://cdn.shopify.com/s/files/1/0487/0491/3558/files/adding_and_subtracting_trig_functions_worksheet.pdf
- https://s3.amazonaws.com/libeganot/aaronic_blessing_in_hebrew.pdf
- https://s3.amazonaws.com/mawesenasijoser/comptia_cysa_study_guide_exam_cs0-_001.pdf
- https://papunagaku.weebly.com/uploads/1/3/1/3/131384156/lutigojogiwu.pdf
- https://sofakixejiz.weebly.com/uploads/1/3/4/2/134265497/kedazulazaji.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/9276785.pdf
- https://cdn.shopify.com/s/files/1/0434/3591/7473/files/69505492444.pdf
- https://cdn.shopify.com/s/files/1/0433/4541/2261/files/56065711193.pdf
- https://cdn.shopify.com/s/files/1/0499/6094/3769/files/61750585390.pdf
- https://cdn.shopify.com/s/files/1/0480/9824/6820/files/51526749160.pdf
- https://cdn.shopify.com/s/files/1/0502/6542/4021/files/84628241148.pdf
- https://cdn.shopify.com/s/files/1/0484/6898/3969/files/bullish_and_bearish_patterns.pdf
- https://cdn.shopify.com/s/files/1/0499/9105/7568/files/reading_comprehension_worksheets_for_year_7.pdf
- https://cdn.shopify.com/s/files/1/0432/5824/9380/files/kumamixezexuzebuzuwurefe.pdf
- https://cdn-cms.f-static.net/uploads/4369141/normal_5f89f8ae3ea5b.pdf
- https://cdn-cms.f-static.net/uploads/4387928/normal_5f962aaba0159.pdf
- https://cdn-cms.f-static.net/uploads/4366655/normal_5f87ff673d7e2.pdf
- https://cdn-cms.f-static.net/uploads/4374374/normal_5f92b699c3d2b.pdf
- https://cdn-cms.f-static.net/uploads/4383132/normal_5f967034665ff.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- cdn.shopify.com
- s3.amazonaws.com
- papunagaku.weebly.com
- sofakixejiz.weebly.com
- dutitujazekap.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report