SUSPICIOUS — vokuzamik.pdf
SUSPICIOUS — vokuzamik.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
bf39b17c64283c55483197b738af7350c350c8f718810706458a75e90430e26c - SHA-1:
cd5f636ac7ac571994aadf88badc25875a6c08f3 - MD5:
2ec0332e888532a35d2a152b3996b315 - ssdeep:
768:7gGzpD0ipPGJYrSZgjIttvFCJ2yAZusNFfDYeC9Nn7Z4qDv:EGFFp8XzfDY59j4qDv - TLSH:
T191317DF71067EE4C7E8B6B83ADA701986489D38D7126E7D048C8762CD4BC6ED6F10921 - Submitted as: vokuzamik.pdf
- File type: pdf · Size: 43208 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=el%20departamento%20de%20ama%20de%20llaves, https://cdn-cms.f-static.net/uploads/4367951/normal_5f87a43578508.pdf, https://cdn-cms.f-static.net/uploads/4366623/normal_5f8782393e022.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=el%20departamento%20de%20ama%20de%20llaves
- https://cdn-cms.f-static.net/uploads/4367951/normal_5f87a43578508.pdf
- https://cdn-cms.f-static.net/uploads/4366623/normal_5f8782393e022.pdf
- https://cdn-cms.f-static.net/uploads/4367938/normal_5f876bd16cb1a.pdf
- https://cdn-cms.f-static.net/uploads/4366399/normal_5f87814be817a.pdf
- https://uploads.strikinglycdn.com/files/64114edc-73ab-43d2-8c66-f21380148a5d/10072095986.pdf
- https://uploads.strikinglycdn.com/files/21b0721c-b46f-485e-a196-c7a35aa0460d/24386045127.pdf
- https://uploads.strikinglycdn.com/files/f65447fe-7fb8-4ab6-8133-5e892ee640bf/pigitajanigiborinudumasof.pdf
- https://uploads.strikinglycdn.com/files/dab0684d-d145-4bc6-9949-fdc6c8a1ac41/74150138790.pdf
- https://uploads.strikinglycdn.com/files/c774ac86-b210-4c54-9d88-4693dde66f21/zafifigiperijovufuki.pdf
- https://site-1044161.mozfiles.com/files/1044161/english_to_bangla_dictionary_apkpure.pdf
- https://site-1040329.mozfiles.com/files/1040329/maytag_gemini_double_oven_installation_manual.pdf
- https://site-1042013.mozfiles.com/files/1042013/85110246926.pdf
- https://site-1043352.mozfiles.com/files/1043352/xuxosize.pdf
- https://cdn-cms.f-static.net/uploads/4366987/normal_5f8750ee9ccbf.pdf
- https://cdn-cms.f-static.net/uploads/4365634/normal_5f873398a8578.pdf
- https://cdn-cms.f-static.net/uploads/4365584/normal_5f87497a89e06.pdf
- https://cdn-cms.f-static.net/uploads/4367013/normal_5f873f8707f46.pdf
- https://cdn-cms.f-static.net/uploads/4366628/normal_5f871f71f2162.pdf
- https://cdn-cms.f-static.net/uploads/4366337/normal_5f874eb2df715.pdf
- https://cdn-cms.f-static.net/uploads/4366003/normal_5f8702ebbaa4a.pdf
- https://cdn-cms.f-static.net/uploads/4366063/normal_5f8775cc63d2e.pdf
- https://site-1040216.mozfiles.com/files/1040216/36578521389.pdf
- https://site-1039423.mozfiles.com/files/1039423/fusowubuwafajapu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- site-1044161.mozfiles.com
- site-1040329.mozfiles.com
- site-1042013.mozfiles.com
- site-1043352.mozfiles.com
- site-1040216.mozfiles.com
- site-1039423.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report