SUSPICIOUS — witaku_pavegar_lemitudilutaw.pdf
SUSPICIOUS — witaku_pavegar_lemitudilutaw.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
ae8f6a1ba88449d615c0e1139f0d7618ff989ce289c35aadef1b5c216b3ff2b0 - SHA-1:
1b0d3bc0d6cd15f7bd80adb8f366507b2dd9b179 - MD5:
103f8c18b7ef8592862fabc5827b7e8c - ssdeep:
768:BgGzpDGqNtBrXGziSElmlQZgWpDRxAM+VEgz0X6/:yGF67IFxAB74X6/ - TLSH:
T11E307DF710EBDD4DBA9A9B13ADE6242920C9C74C623397A444DC672CC0BC2BD2F20951 - Submitted as: witaku_pavegar_lemitudilutaw.pdf
- File type: pdf · Size: 38540 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=miracle%20on%20ice%20movie%20worksheet, https://cdn.shopify.com/s/files/1/0502/2993/6282/files/tugidajixomujafuxigepodo.pdf, https://cdn.shopify.com/s/files/1/0482/7643/9198/files/phi_sigma_rho_penn_state.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=miracle%20on%20ice%20movie%20worksheet
- https://cdn.shopify.com/s/files/1/0502/2993/6282/files/tugidajixomujafuxigepodo.pdf
- https://cdn.shopify.com/s/files/1/0482/7643/9198/files/phi_sigma_rho_penn_state.pdf
- https://uploads.strikinglycdn.com/files/0480c091-2d3d-4c5e-99b4-1e59b1a42214/jcb_506c_service_manual.pdf
- https://cdn-cms.f-static.net/uploads/4382208/normal_5f9372e030954.pdf
- https://s3.amazonaws.com/baxunaf/43116690665.pdf
- https://uploads.strikinglycdn.com/files/4c85eda7-21b9-4299-a145-e5596ac91dec/sobesenovusaxavaranabeteb.pdf
- https://s3.amazonaws.com/wotodedaruzuk/insertional_achilles_tendonitis_treatment_exercises.pdf
- https://uploads.strikinglycdn.com/files/f230f42f-72d9-4cd6-ad46-22266a3d5693/dozufaboweregilegurenus.pdf
- https://s3.amazonaws.com/xanebavifamopez/vavupelimuturepifusuboji.pdf
- https://cdn.shopify.com/s/files/1/0503/3879/1582/files/download_daftar_riwayat_hidup_2020.pdf
- https://s3.amazonaws.com/fujadabez/malta_cerveza.pdf
- https://uploads.strikinglycdn.com/files/8bf45866-3534-4f05-a10a-b20f2bca49ad/gofidir.pdf
- https://cdn.shopify.com/s/files/1/0502/9786/4386/files/oregon_scientific_thn132n_wireless_temperature_sensor_manual.pdf
- https://cdn-cms.f-static.net/uploads/4376380/normal_5f91d1fa31f04.pdf
- https://cdn.shopify.com/s/files/1/0488/1442/4229/files/screenbeam_mini_2_amazon.pdf
- https://uploads.strikinglycdn.com/files/9cecc478-548c-4eea-96fa-9dac9ef64ed2/time_card_template_free_printable.pdf
- https://uploads.strikinglycdn.com/files/e8e8eaa2-31c3-4d02-ae2e-8d694860d311/dazogiba.pdf
- https://s3.amazonaws.com/gupuso/88574821761.pdf
- https://cdn.shopify.com/s/files/1/0438/3526/1085/files/the_lost_secrets_of_freemasonry.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- cctraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report