SUSPICIOUS — fujebumajizanetepakozemus.pdf

SUSPICIOUS — fujebumajizanetepakozemus.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 9cbeee30c2ea206cae9cecc6735613302badc790cca4ab3d61f277528d5bab6a
• SHA-1: e27562b41db8b12f52ad95a44d5ceee66c4e84e9
• MD5: 070d199b6d9061b4e0bf91a1d03a7167
• ssdeep: 768:tgGzpD1O0u84aebIPMzSw6AVtG2NdLLqA+WWaM:OGFhsqktGQdL2hWWaM
• TLSH: T116307EF300A7ED8C7B8E9B43ADAB1199A447D7C86133966004CC7B2CC4BCABD6E11560
• Submitted as: fujebumajizanetepakozemus.pdf
• File type: pdf · Size: 36812 bytes
• Verdict: suspicious (44/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=7.+3+idi+glow+plugs, http://files.stephenweberdr.com/uploads/1/3/1/4/131437849/xetefatolopupo-kaviga-fanazokus-wojatotuzu.pdf, http://files.stillmomentsbycarmen.com/uploads/1/3/1/4/131408103/xawiro_pubuwavabil.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/strik?keyword=7.+3+idi+glow+plugs
• http://files.stephenweberdr.com/uploads/1/3/1/4/131437849/xetefatolopupo-kaviga-fanazokus-wojatotuzu.pdf
• http://files.stillmomentsbycarmen.com/uploads/1/3/1/4/131408103/xawiro_pubuwavabil.pdf
• http://files.forevernursing.org/uploads/1/3/2/6/132682790/perovixekukizisof.pdf
• http://files.tinydapperfox.com/uploads/1/3/1/3/131379769/44f4336f3f.pdf
• http://files.key2evolve.com/uploads/1/3/0/8/130874318/zasabuxemer_xawapikiguromik_balasoge.pdf
• http://zemako.aspiritualtale.com/uploads/1/3/1/3/131382274/pijalojunebe.pdf
• http://dosozogaz.goldaes.com/uploads/1/3/1/3/131378950/606088.pdf
• http://winomi.ponderosabasinwater.com/uploads/1/3/2/6/132695829/3095442.pdf
• http://files.bigislandpartyrentals.com/uploads/1/3/1/1/131163908/wokozowe-vafitidojoriki-sonabebaziwo-mijaxirolalubar.pdf
• http://gasawevak.trinitybengals.com/uploads/1/3/1/6/131607063/xemuxo.pdf
• http://dutobu.olympiaquestions.com/uploads/1/3/1/3/131398020/vixigadovo.pdf
• http://sokifi.aoifesodenglass.com/uploads/1/3/2/6/132695569/3783667.pdf
• https://cdn.shopify.com/s/files/1/0483/9928/6429/files/lamp_shade_fitter_types.pdf
• https://cdn.shopify.com/s/files/1/0434/7969/5517/files/vewujilenilitepevep.pdf
• https://cdn.shopify.com/s/files/1/0485/3078/4411/files/5665651490.pdf
• https://cdn.shopify.com/s/files/1/0440/6122/9208/files/lose_hope_in_humanity.pdf
• https://cdn.shopify.com/s/files/1/0484/9041/4230/files/jexobudule.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• files.stephenweberdr.com
• files.stillmomentsbycarmen.com
• files.forevernursing.org
• files.tinydapperfox.com
• files.key2evolve.com
• zemako.aspiritualtale.com
• dosozogaz.goldaes.com
• winomi.ponderosabasinwater.com
• files.bigislandpartyrentals.com
• gasawevak.trinitybengals.com
• dutobu.olympiaquestions.com
• sokifi.aoifesodenglass.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report