SUSPICIOUS — xetagojaz.pdf
SUSPICIOUS — xetagojaz.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
9cd10e833f1098056fd67df2d9cd4ce50b3599ef8615ad013ca9d3c7ad015a42 - SHA-1:
fa912fb80c87d93624a8704fc3a9c5695477bf96 - MD5:
b210f2e7dd310142ff7d5cdf2c0ccbaf - ssdeep:
768:2gGzpDA5dIophJzx8+l4tEzwKks7UDDGdNv1OwLhG+1Feqz08zdhikus8p19HQ:jGFUd8EzXzIDD0v9LZe808Zdus4zHQ - TLSH:
T112337CF350A3EC8C7B8F9F036DAB1569518AC74D6132A6A0048C676DD0BC6FE6F01661 - Submitted as: xetagojaz.pdf
- File type: pdf · Size: 48372 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=norden%20communication%20pdf, https://cdn-cms.f-static.net/uploads/4375076/normal_5f8c8f4ff3cbb.pdf, https://cdn-cms.f-static.net/uploads/4366625/normal_5f876ef6d6c34.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=norden%20communication%20pdf
- https://s3.amazonaws.com/jamokaroxoj/well_cementing_calculations.pdf
- https://s3.amazonaws.com/henghuili-files/bimafuresod.pdf
- https://s3.amazonaws.com/jivuxo/858478818.pdf
- https://s3.amazonaws.com/xipavir/entrepreneurship_mba_books.pdf
- https://s3.amazonaws.com/fatisake/2015_buick_enclave_owner_s_manual.pdf
- https://cdn-cms.f-static.net/uploads/4375076/normal_5f8c8f4ff3cbb.pdf
- https://cdn-cms.f-static.net/uploads/4366625/normal_5f876ef6d6c34.pdf
- https://cdn-cms.f-static.net/uploads/4368741/normal_5f8c0e35bfbeb.pdf
- https://cdn-cms.f-static.net/uploads/4368747/normal_5f893cb416b9e.pdf
- https://s3.amazonaws.com/memul/pibarav.pdf
- https://s3.amazonaws.com/buxoparadazegu/autocad_2019_floor_plan_tutorial.pdf
- https://s3.amazonaws.com/sedimeraxufi/99462224257.pdf
- https://s3.amazonaws.com/sugaguxagu/calculus_textbook_pearson.pdf
- https://cdn.shopify.com/s/files/1/0498/2626/7291/files/xavoxudak.pdf
- https://cdn.shopify.com/s/files/1/0479/6694/5447/files/guided_bus_tours_london.pdf
- https://cdn.shopify.com/s/files/1/0496/6239/4517/files/61415240178.pdf
- https://cdn.shopify.com/s/files/1/0477/6348/8924/files/dll_fixer_license_key_3.3.91.pdf
- https://cdn.shopify.com/s/files/1/0428/3973/6487/files/23957949265.pdf
- https://s3.amazonaws.com/gumegulaxi/93406629260.pdf
- https://s3.amazonaws.com/dapekufoxiraku/hernia_femoral_estrangulada.pdf
- https://s3.amazonaws.com/sugaguxagu/simovuridedinevaradis.pdf
- https://s3.amazonaws.com/bepukuba/zufofidatofinanokume.pdf
- https://s3.amazonaws.com/tetazino/74506784740.pdf
- https://s3.amazonaws.com/fujadabez/basic_electrical_engineering_book_2018.pdf
Embedded domains
- cctraff.ru
- s3.amazonaws.com
- cdn-cms.f-static.net
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report