SUSPICIOUS — xojamaz.pdf
SUSPICIOUS — xojamaz.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 53 detection engines flagged it.
Identification
- SHA-256:
9e2b978f4c3c985793334c0c93514e8b0ba8fc6274b76d49ff6a6ca5e0d5c52c - SHA-1:
4bf53dc7d69859244f66fd35253f110a06a916e7 - MD5:
50e9902c656cf42fd07cf20132d8d66c - ssdeep:
768:tgGzpD7p3UG9zhC8Upz0DQ2UlKIQJKozkaUj5fqV/wPO:OGFXp3nDtbIQ4ozkXjto/wPO - TLSH:
T14A305CF300A7ED8C7A879B43B8AA399DA049E7887133A7504998362DC57C3BD7F10561 - Submitted as: xojamaz.pdf
- File type: pdf · Size: 37675 bytes
- Verdict: suspicious (35/100)
Detections (1 of 53 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=convertir%20archivos%20word%20a%20pdf%20en%20linea%20gratis, https://cdn-cms.f-static.net/uploads/4379029/normal_5f9419362783b.pdf, https://cdn.shopify.com/s/files/1/0429/3004/5091/files/bpsc_2020_prelims_question_paper.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=convertir%20archivos%20word%20a%20pdf%20en%20linea%20gratis
- https://s3.amazonaws.com/nerugiraxura/centrifugation_principle_types_and_applications.pdf
- https://s3.amazonaws.com/kudufigunabi/furanirilidivekibalufuzov.pdf
- https://s3.amazonaws.com/zirojopemup/4018763436.pdf
- https://s3.amazonaws.com/felasorarabipis/gufedoviti.pdf
- https://s3.amazonaws.com/pozokimepe/peluni.pdf
- https://cdn-cms.f-static.net/uploads/4379029/normal_5f9419362783b.pdf
- https://cdn.shopify.com/s/files/1/0429/3004/5091/files/bpsc_2020_prelims_question_paper.pdf
- https://cdn.shopify.com/s/files/1/0433/9620/2652/files/managing_oneself_peter_drucker.pdf
- https://cdn.shopify.com/s/files/1/0502/7984/1954/files/purejuzagajadoxuwig.pdf
- https://cdn.shopify.com/s/files/1/0268/9466/3865/files/android_p_vs_ios_11.pdf
- https://cdn.shopify.com/s/files/1/0501/7347/7052/files/48622982115.pdf
- https://wugovokida.weebly.com/uploads/1/3/4/3/134319073/jusomubamura-zopofizuvi.pdf
- https://runebipunozup.weebly.com/uploads/1/3/1/4/131406604/2637392.pdf
- https://zasiranel.weebly.com/uploads/1/3/4/5/134507270/2357927.pdf
- https://cdn.shopify.com/s/files/1/0485/9271/5941/files/fotepafopidiwew.pdf
- https://cdn.shopify.com/s/files/1/0437/7001/9994/files/theories_of_public_policy_formulation.pdf
- https://s3.amazonaws.com/wonoti/perkembangan_akuntansi_internasional.pdf
- https://s3.amazonaws.com/jepavilutabilel/jilumibekalorisebaduse.pdf
- https://s3.amazonaws.com/felasorarabipis/alimentos_fibra_soluble.pdf
- https://s3.amazonaws.com/damerirazib/73065949474.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ggtraff.ru
- s3.amazonaws.com
- cdn-cms.f-static.net
- cdn.shopify.com
- wugovokida.weebly.com
- runebipunozup.weebly.com
- zasiranel.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report