SUSPICIOUS — jowafizolosabobo.pdf
SUSPICIOUS — jowafizolosabobo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
9b7452a8093dd38cea726ce0718eeb4d3d613dfa880361553c941ff30cb073f3 - SHA-1:
1c79802a666f91e64f31fd61bff09a8b479bdc55 - MD5:
dfc1b214a0e5df20a1e33da419bd9d89 - ssdeep:
3072:sF+pfqocTvHZJAeVUe8F05dFseJIBi//XZisD/II1YS6Sp3kzzf3jB40X7jrKk/R:kYf8ZDUe8WPJF/RDXD8zbBFGQR - TLSH:
T1FA4302F7109BFF4C7BCBC7AF9C6A41B966A9C3085676C7200658670CD1B8EDEA844940 - Submitted as: jowafizolosabobo.pdf
- File type: pdf · Size: 230785 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=300%20tang%20poems, https://site-1043810.mozfiles.com/files/1043810/memukabopezumu.pdf, https://site-1039721.mozfiles.com/files/1039721/6564877059.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=300%20tang%20poems
- https://site-1043810.mozfiles.com/files/1043810/memukabopezumu.pdf
- https://site-1039721.mozfiles.com/files/1039721/6564877059.pdf
- https://site-1039174.mozfiles.com/files/1039174/vilekisuloranex.pdf
- https://site-1037848.mozfiles.com/files/1037848/movufadewuwopo.pdf
- https://site-1040131.mozfiles.com/files/1040131/86821046991.pdf
- https://site-1037024.mozfiles.com/files/1037024/zopug.pdf
- https://site-1037837.mozfiles.com/files/1037837/wefurawidugape.pdf
- https://cdn-cms.f-static.net/uploads/4365549/normal_5f86f99f5f9e8.pdf
- https://cdn-cms.f-static.net/uploads/4366639/normal_5f884f1ba82a2.pdf
- https://cdn-cms.f-static.net/uploads/4365646/normal_5f8716e88c558.pdf
- https://cdn-cms.f-static.net/uploads/4367271/normal_5f8738b0e94b1.pdf
- https://cdn-cms.f-static.net/uploads/4366406/normal_5f87ddbe02d91.pdf
- https://cdn.shopify.com/s/files/1/0483/9925/3661/files/65775397550.pdf
- https://cdn.shopify.com/s/files/1/0501/7547/5872/files/f_to_m_transition_bottom_surgery_sensation.pdf
- https://cdn.shopify.com/s/files/1/0440/6755/3430/files/gudexozusuwosejegudopukoj.pdf
- https://cdn.shopify.com/s/files/1/0495/9921/7827/files/roaming_high_value_captain_nessus.pdf
- https://cdn.shopify.com/s/files/1/0439/4916/2654/files/15_minute_manifestation_free.pdf
- https://site-1043664.mozfiles.com/files/1043664/43739383164.pdf
- https://site-1036881.mozfiles.com/files/1036881/baxibori.pdf
- https://site-1039503.mozfiles.com/files/1039503/rilimudaluzezujakib.pdf
- https://site-1037251.mozfiles.com/files/1037251/lutadajizurakukipikap.pdf
- https://site-1043374.mozfiles.com/files/1043374/murajomukajebaporazizukiw.pdf
- https://site-1041933.mozfiles.com/files/1041933/69001909490.pdf
- https://site-1043288.mozfiles.com/files/1043288/3949565290.pdf
Embedded domains
- cctraff.ru
- site-1043810.mozfiles.com
- site-1039721.mozfiles.com
- site-1039174.mozfiles.com
- site-1037848.mozfiles.com
- site-1040131.mozfiles.com
- site-1037024.mozfiles.com
- site-1037837.mozfiles.com
- cdn-cms.f-static.net
- cdn.shopify.com
- site-1043664.mozfiles.com
- site-1036881.mozfiles.com
- site-1039503.mozfiles.com
- site-1037251.mozfiles.com
- site-1043374.mozfiles.com
- site-1041933.mozfiles.com
- site-1043288.mozfiles.com
- site-1042729.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report