SUSPICIOUS — fezumuzemetemun.pdf
SUSPICIOUS — fezumuzemetemun.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
b83af845c702c3d6861b29244f8b2ba3df44f68d6eac7e4c39efe55a211e4a50 - SHA-1:
d9085b5b77b41338d34d0a7a350f032a36056448 - MD5:
2927953c609e875579151d448e4cfb62 - ssdeep:
768:XgGzpDseXF2bO3TcUnJ3+0YBpIwYIWduLOOqqYiWHNviOoeYL7gSmymvsp:wGFweXdTVp+0YB3DxWHNvdYLkSkvsp - TLSH:
T1C1338DF310A7ED8C7ACFAF075DAB1599648AD78DB132A6504888773CC4FC5AC6E10560 - Submitted as: fezumuzemetemun.pdf
- File type: pdf · Size: 51365 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=merge%20pdf%20file%20free%20software, https://cdn-cms.f-static.net/uploads/4365589/normal_5f86f4053534e.pdf, https://winomumamo.weebly.com/uploads/1/3/1/0/131070375/bffe920c.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=merge%20pdf%20file%20free%20software
- https://s3.amazonaws.com/waxapoz/budgetary_process.pdf
- https://s3.amazonaws.com/henghuili-files2/fitly_spoken_developing_effective_communication_and_social_skills.pdf
- https://s3.amazonaws.com/felasorarabipis/fujowegekeku.pdf
- https://s3.amazonaws.com/kavitokolezub/bwssb_recruitment_notification.pdf
- https://s3.amazonaws.com/vuzufexarevima/nizuda.pdf
- https://cdn-cms.f-static.net/uploads/4365589/normal_5f86f4053534e.pdf
- https://winomumamo.weebly.com/uploads/1/3/1/0/131070375/bffe920c.pdf
- https://narogigadi.weebly.com/uploads/1/3/0/8/130874066/c2099e721b.pdf
- https://babikovinemixe.weebly.com/uploads/1/3/1/8/131856339/nifit.pdf
- https://dapujevubo.weebly.com/uploads/1/3/1/4/131438680/wijedenivox.pdf
- https://kizekusoviwo.weebly.com/uploads/1/3/1/4/131453028/044dfdd0190b5a1.pdf
- https://cdn-cms.f-static.net/uploads/4379048/normal_5f8a2dd376a7f.pdf
- https://cdn-cms.f-static.net/uploads/4367622/normal_5f8a25578c8ad.pdf
- https://cdn-cms.f-static.net/uploads/4401538/normal_5f907179a73f5.pdf
- https://cdn-cms.f-static.net/uploads/4365619/normal_5f87c5a87ef70.pdf
- https://cdn-cms.f-static.net/uploads/4380681/normal_5f8c23592696d.pdf
- https://s3.amazonaws.com/tetenifeme/hofmann_bromamide_reaction.pdf
- https://s3.amazonaws.com/zuxadol/13365743456.pdf
- https://s3.amazonaws.com/susopuzupure/although_even_though_however.pdf
- https://s3.amazonaws.com/sugaguxagu/antioxidants_nutrition.pdf
- https://s3.amazonaws.com/bivanud/english_to_marathi_dictionary_file_free_download.pdf
- https://s3.amazonaws.com/tadovu/xijepobik.pdf
- https://s3.amazonaws.com/memul/mikorudomesoxe.pdf
- https://s3.amazonaws.com/zetare/caracteristicas_de_autoestima_alta_y_baja.pdf
Embedded domains
- gettraff.ru
- s3.amazonaws.com
- cdn-cms.f-static.net
- winomumamo.weebly.com
- narogigadi.weebly.com
- babikovinemixe.weebly.com
- dapujevubo.weebly.com
- kizekusoviwo.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report