SUSPICIOUS — fewit-latafele.pdf
SUSPICIOUS — fewit-latafele.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
c27e2706568f4db2f45b4506937743832c0f677e160c2f91e52c54b6ce020ca5 - SHA-1:
c29f50aa54fcad7a94b4648ca6fac4e470617ca8 - MD5:
3b89508185cb34d9483fbd70f6a77d93 - ssdeep:
768:JgGzpDNpqB+Z6UMSmZXR+64jqfWkkZe8ZRvOoT2gvzqQeSNCFbB:qGFZpufWkz8ZRvVT2gvzRN0bB - TLSH:
T164306BF310E7DD8C7E8B5B53A9E6019A808AD748A037D7A0458CB71DC8BC6AD7E50D60 - Submitted as: fewit-latafele.pdf
- File type: pdf · Size: 37339 bytes
- Verdict: suspicious (35/100)
Detections (1 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=black%20legion%20market, https://cdn-cms.f-static.net/uploads/4365628/normal_5f86f4bdb2dfb.pdf, https://cdn-cms.f-static.net/uploads/4366639/normal_5f87274584495.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=black%20legion%20market
- https://cdn-cms.f-static.net/uploads/4365628/normal_5f86f4bdb2dfb.pdf
- https://cdn-cms.f-static.net/uploads/4366639/normal_5f87274584495.pdf
- https://cdn-cms.f-static.net/uploads/4365525/normal_5f870bf5678ce.pdf
- https://cdn-cms.f-static.net/uploads/4365642/normal_5f87117a12c6d.pdf
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/laresisif_kigadebokenub_bajutinerid.pdf
- https://tavumake.weebly.com/uploads/1/3/2/7/132740551/4ce065df.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/kadijamiruvinugeno.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/jogowezokuvaxu.pdf
- https://mupibidegupek.weebly.com/uploads/1/3/0/8/130874042/64722d3.pdf
- https://site-1044115.mozfiles.com/files/1044115/33144743024.pdf
- https://site-1042627.mozfiles.com/files/1042627/didekowilutorunadirusomug.pdf
- https://site-1037824.mozfiles.com/files/1037824/41261743422.pdf
- https://site-1042501.mozfiles.com/files/1042501/99347249997.pdf
- https://cdn-cms.f-static.net/uploads/4365582/normal_5f871b0df0003.pdf
- https://cdn-cms.f-static.net/uploads/4366339/normal_5f871a4cd22ca.pdf
- https://cdn-cms.f-static.net/uploads/4366048/normal_5f870f8be090e.pdf
- https://cdn-cms.f-static.net/uploads/4365525/normal_5f86fac65e5fe.pdf
- https://cdn-cms.f-static.net/uploads/4365552/normal_5f86f8ebebd59.pdf
- https://uploads.strikinglycdn.com/files/ddd4bb0c-fce7-4a6a-a6d9-472f9046d027/bitimunupoxiti.pdf
- https://uploads.strikinglycdn.com/files/93867707-801b-4593-be88-2d260d52a3da/44383785473.pdf
- https://uploads.strikinglycdn.com/files/21e4bd22-de95-4dea-b99b-2548338c3707/2999961825.pdf
- https://cdn-cms.f-static.net/uploads/4366032/normal_5f87135fb91ad.pdf
- https://cdn-cms.f-static.net/uploads/4366005/normal_5f8711beb747e.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f87030ec8941.pdf
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- genigudepa.weebly.com
- tavumake.weebly.com
- dutitujazekap.weebly.com
- zoxuzuxebexot.weebly.com
- mupibidegupek.weebly.com
- site-1044115.mozfiles.com
- site-1042627.mozfiles.com
- site-1037824.mozfiles.com
- site-1042501.mozfiles.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report