SUSPICIOUS — xiwumomodib.pdf
SUSPICIOUS — xiwumomodib.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
bce2bbc599f5930f1f8fa4b0ae1c339203b8ff7ef4d3ae18976b58eb71b6084f - SHA-1:
d39d4a68300eec5adfd25c7d95d6f2773ece44eb - MD5:
c1f2a8a5f77c0fa836da3ae37596462d - ssdeep:
768:OgGzpDQpP4SCHQ09fkTjPOcYOO8ZDlnl/r38Xe3x5taDMo8s7uSQv:rGFcpP4S9YcZDbwk5gMolKSQv - TLSH:
T181328DF340A7ED4C7A879B43AEAE311E854AD2896133A75054DC6B2DC4BC3BD7E10A50 - Submitted as: xiwumomodib.pdf
- File type: pdf · Size: 46832 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=troy%20bilt%20tb22%20ec%20pull%20cord, https://uploads.strikinglycdn.com/files/618de3dd-1fc4-4e70-b891-2ada55ce41a3/mokadudadafometobos.pdf, https://uploads.strikinglycdn.com/files/1d3924d7-6491-4356-b9b2-cd4ba460dc04/wavelugeve.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=troy%20bilt%20tb22%20ec%20pull%20cord
- https://uploads.strikinglycdn.com/files/618de3dd-1fc4-4e70-b891-2ada55ce41a3/mokadudadafometobos.pdf
- https://uploads.strikinglycdn.com/files/1d3924d7-6491-4356-b9b2-cd4ba460dc04/wavelugeve.pdf
- https://uploads.strikinglycdn.com/files/6756824d-958f-4736-be08-beee3481459f/18954603498.pdf
- https://uploads.strikinglycdn.com/files/72544f28-dde9-47e8-a0ae-8a0b90afedab/76213772012.pdf
- https://cdn.shopify.com/s/files/1/0493/1865/8207/files/82624521254.pdf
- https://cdn.shopify.com/s/files/1/0427/7652/7014/files/free_employee_handbook_template_ireland.pdf
- https://cdn.shopify.com/s/files/1/0434/1740/3549/files/a1c_conversion_chart.pdf
- https://cdn.shopify.com/s/files/1/0436/2626/6782/files/logileminejejonarugefaw.pdf
- https://uploads.strikinglycdn.com/files/34f05674-d88d-4160-9e25-13e3e0df8a50/gerenuzapexiserofosamedok.pdf
- https://uploads.strikinglycdn.com/files/83a029f5-a991-4189-baf2-674fdefafa2d/13434633678.pdf
- https://uploads.strikinglycdn.com/files/56ea303c-ebf5-40a3-ab55-a26577cc7f7e/60287329154.pdf
- https://uploads.strikinglycdn.com/files/51400090-0669-4014-9dcc-66556aef3de7/65735243546.pdf
- https://uploads.strikinglycdn.com/files/9c4af884-7d29-4a07-bbc7-3673b30adefa/21051387041.pdf
- https://uploads.strikinglycdn.com/files/4ca07638-ac63-4217-9700-109332e31678/15142263562.pdf
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/8e42bfb8d1b0f.pdf
- https://vezorobabuwej.weebly.com/uploads/1/3/0/9/130969079/xesob-wonuxosowavufi.pdf
- https://nunoperiv.weebly.com/uploads/1/3/1/8/131856708/7fd7b.pdf
- https://megadezatesaram.weebly.com/uploads/1/3/0/7/130776649/b97e7.pdf
- https://mupibidegupek.weebly.com/uploads/1/3/0/8/130874042/8924004.pdf
- https://cdn.shopify.com/s/files/1/0497/5843/7530/files/20337555980.pdf
- https://cdn.shopify.com/s/files/1/0268/8991/2491/files/64598058308.pdf
- https://cdn.shopify.com/s/files/1/0480/0289/1935/files/wings_of_fire_winglets_books.pdf
- https://cdn.shopify.com/s/files/1/0439/8042/3326/files/assef_kite_runner_character_analysis.pdf
- https://cdn.shopify.com/s/files/1/0266/8235/9994/files/calculus_paul_a_foerster_answers.pdf
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- bedizegoresupa.weebly.com
- vezorobabuwej.weebly.com
- nunoperiv.weebly.com
- megadezatesaram.weebly.com
- mupibidegupek.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report