SUSPICIOUS — pimibopigafe.pdf
SUSPICIOUS — pimibopigafe.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
b6f27f8d301ddff4e4fc15dd573279516a56cdc56200a7b80a95f7a47843e515 - SHA-1:
54e913ab076da032a7f40ddb65205432a9180d70 - MD5:
52ea3e19224244d3d0a54a3ba84898c7 - ssdeep:
768:LgGzpDjpiFhumjeIPJHiNxW6TpylTmZiHEE6F4sa3A0bFWsCtDrOCFHytmBcZZw:0GFXpimDPTslTzEzFOYsYCC88cZZw - TLSH:
T123327CF34093ED4C7B8F9B17ADEB205A5189D388A137A7A455887A7CC07C2ED7E10861 - Submitted as: pimibopigafe.pdf
- File type: pdf · Size: 43790 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=ruggear%20rg129%20manual, https://cdn.shopify.com/s/files/1/0268/8404/7047/files/decompression_sickness_treatment.pdf, https://cdn.shopify.com/s/files/1/0505/6652/9218/files/bazutuvovopudirefipumugaj.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=ruggear%20rg129%20manual
- https://s3.amazonaws.com/fosagoba/cahiers_pour_l_analyse.pdf
- https://s3.amazonaws.com/fasanag/behringer_crossover_manual.pdf
- https://s3.amazonaws.com/waxapoz/varicocele_tratamiento.pdf
- https://s3.amazonaws.com/jamokaroxoj/t1013_form.pdf
- https://s3.amazonaws.com/zuxadol/autosketch_tutorial.pdf
- https://s3.amazonaws.com/wonoti/lekozupemaje.pdf
- https://s3.amazonaws.com/mijedusovineti/57426937601.pdf
- https://s3.amazonaws.com/subud/xubuzidazagaganobudi.pdf
- https://s3.amazonaws.com/zirojopemup/tosobelibojavojilaguk.pdf
- https://s3.amazonaws.com/mijedusovineti/46794255241.pdf
- https://s3.amazonaws.com/leguvefu/balarama_malayalam_book.pdf
- https://s3.amazonaws.com/jamokaroxoj/55120113484.pdf
- https://s3.amazonaws.com/memul/biometric_voting_system.pdf
- https://s3.amazonaws.com/felasorarabipis/50124000772.pdf
- https://s3.amazonaws.com/henghuili-files/nigakabozudo.pdf
- https://s3.amazonaws.com/zuxadol/kenovatigeda.pdf
- https://s3.amazonaws.com/wilugugo/55659744485.pdf
- https://s3.amazonaws.com/mijedusovineti/janigusebidasodogodukodox.pdf
- https://cdn.shopify.com/s/files/1/0268/8404/7047/files/decompression_sickness_treatment.pdf
- https://cdn.shopify.com/s/files/1/0505/6652/9218/files/bazutuvovopudirefipumugaj.pdf
- https://cdn.shopify.com/s/files/1/0486/4393/2318/files/asu_prep_academy_mesa.pdf
- https://cdn.shopify.com/s/files/1/0501/2973/1777/files/suzonodabiwuvumamaluvazed.pdf
- https://cdn.shopify.com/s/files/1/0482/2056/9752/files/luxixubidipopopiwunax.pdf
- https://cdn.shopify.com/s/files/1/0500/5003/9976/files/39609123757.pdf
Embedded domains
- cctraff.ru
- s3.amazonaws.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report