SUSPICIOUS — gafutalakisibivodufinenoz.pdf
SUSPICIOUS — gafutalakisibivodufinenoz.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
9cc861af204874f367ebcecba270a633e85f39e9e790d770da5bbb568da911d6 - SHA-1:
c7d92648474789378b20c00352206005b46a89bc - MD5:
72f7bc30f191f0f6e17dcbb018fc34b3 - ssdeep:
3072:zFogFGMLQC1PUwvExuSh3l1EOx6Xv3/dXqz1AxNunsrXx4HFbjyi/wyo:hlF/LL1PUBxu4Vuak3/dazK/eIn - TLSH:
T10F3F01F350ABDC8C7A8ECF23E2AB145A7546D68D9132D6B55188239CC57C3BD2F12980 - Submitted as: gafutalakisibivodufinenoz.pdf
- File type: pdf · Size: 163460 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=%25D9%2585%25D8%25B9%25D9%2586%25D9%2589+ppm+%25D9%2581%25D9%258A+%25D8%25A7%25D9%2584%25D8%25B5%25D9%258A%25D8%25A7%25D9%2586%25D8%25A9, https://cdn.shopify.com/s/files/1/0496/2700/5124/files/preamble_to_the_us_constitution.pdf, https://cdn.shopify.com/s/files/1/0505/4644/2405/files/cricut_easypress_2_settings_guide.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/strik?keyword=%25D9%2585%25D8%25B9%25D9%2586%25D9%2589+ppm+%25D9%2581%25D9%258A+%25D8%25A7%25D9%2584%25D8%25B5%25D9%258A%25D8%25A7%25D9%2586%25D8%25A9
- https://cdn.shopify.com/s/files/1/0496/2700/5124/files/preamble_to_the_us_constitution.pdf
- https://cdn.shopify.com/s/files/1/0505/4644/2405/files/cricut_easypress_2_settings_guide.pdf
- https://cdn.shopify.com/s/files/1/0484/6996/7013/files/wechat_application_download_for_android.pdf
- https://cdn-cms.f-static.net/uploads/4371010/normal_5f8d03277341c.pdf
- https://cdn-cms.f-static.net/uploads/4382004/normal_5f8b6f4061960.pdf
- https://cdn-cms.f-static.net/uploads/4365562/normal_5f8778cc79769.pdf
- https://cdn-cms.f-static.net/uploads/4366365/normal_5f87b0d52f0ef.pdf
- https://polabufasol.weebly.com/uploads/1/3/2/8/132814050/buvazil.pdf
- https://liwifaxuje.weebly.com/uploads/1/3/0/8/130874244/4cf41af4.pdf
- https://pavowojavujide.weebly.com/uploads/1/3/1/3/131398322/murusugase-sidagotakem-kamesadomodater.pdf
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/zutilipevozafeguwu.pdf
- https://xojerajap.weebly.com/uploads/1/3/1/3/131384359/2122744.pdf
- https://xutewosabog.weebly.com/uploads/1/3/2/3/132303209/a61fb983.pdf
- https://xujaxivef.weebly.com/uploads/1/3/1/4/131438557/weseniwajela-lemufijito-jenuwugagimexon-nodajabexubolo.pdf
- https://povutepumik.weebly.com/uploads/1/3/2/7/132741486/lejegumonivixaro.pdf
- https://cdn.shopify.com/s/files/1/0477/3730/7292/files/golejeda.pdf
- https://cdn.shopify.com/s/files/1/0492/4692/9052/files/control_undead_feat_pathfinder.pdf
- https://cdn.shopify.com/s/files/1/0481/2498/5497/files/harris_middle_school_spruce_pine_north_carolina.pdf
- https://cdn.shopify.com/s/files/1/0483/6802/5751/files/kick_the_buddy_forever_mod_apk.pdf
- https://cdn.shopify.com/s/files/1/0482/4104/9752/files/29102676230.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- polabufasol.weebly.com
- liwifaxuje.weebly.com
- pavowojavujide.weebly.com
- guwomenod.weebly.com
- xojerajap.weebly.com
- xutewosabog.weebly.com
- xujaxivef.weebly.com
- povutepumik.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report