SUSPICIOUS — jodofalem.pdf
SUSPICIOUS — jodofalem.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
c42ec5adb195f6683ae99a8417bd7955bba2c18c48e6058f6c1e70368d107dff - SHA-1:
3626cb3117c896d9c6959de733fcc394578e2437 - MD5:
216d88c70499258dc210f7b887cefee2 - ssdeep:
1536:8GF1pjEE26mOTdBjwOgGszWuHGo9eCv2:ZF1pZmMPjwOgzRmmG - TLSH:
T1D9339DF34497DC4C7B8E9B03ACEB1168118AD78D6262E7A0558C376CE4BC5BEBE10560 - Submitted as: jodofalem.pdf
- File type: pdf · Size: 50042 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=free%20blank%20calligraphy%20practice%20sheets, https://uploads.strikinglycdn.com/files/2a52fa91-2d1c-42fa-9e30-8e8e6474d0e6/lebanuwepusuwulujigumokob.pdf, https://uploads.strikinglycdn.com/files/e473f1da-8171-41dd-bce8-8a6fe5258b00/lixobivaxenezivoxonimonin.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=free%20blank%20calligraphy%20practice%20sheets
- https://uploads.strikinglycdn.com/files/2a52fa91-2d1c-42fa-9e30-8e8e6474d0e6/lebanuwepusuwulujigumokob.pdf
- https://uploads.strikinglycdn.com/files/e473f1da-8171-41dd-bce8-8a6fe5258b00/lixobivaxenezivoxonimonin.pdf
- https://uploads.strikinglycdn.com/files/af4023ed-74ba-44b2-bf50-881cc5619f9d/wovobufiletijede.pdf
- https://uploads.strikinglycdn.com/files/c80e4402-9219-4fe8-8766-f32624496f2c/xuzujos.pdf
- https://uploads.strikinglycdn.com/files/a1007304-13d6-4b6a-8299-fb0083c93693/17650968192.pdf
- https://site-1039787.mozfiles.com/files/1039787/foxit_creator_64_bit_full.pdf
- https://site-1041378.mozfiles.com/files/1041378/92883812187.pdf
- https://site-1040326.mozfiles.com/files/1040326/kawonowi.pdf
- https://site-1039301.mozfiles.com/files/1039301/48095590899.pdf
- https://cdn.shopify.com/s/files/1/0434/4492/8674/files/louisiana_interactive_science_grade_6_answers.pdf
- https://cdn.shopify.com/s/files/1/0440/4330/5110/files/wagofuzosewosevezenowizoj.pdf
- https://cdn.shopify.com/s/files/1/0434/8408/6424/files/pinebixefonakukuso.pdf
- https://cdn.shopify.com/s/files/1/0484/7937/1414/files/gallon_of_ice_cream_calories.pdf
- https://site-1043034.mozfiles.com/files/1043034/39133637636.pdf
- https://site-1043195.mozfiles.com/files/1043195/raxolujifosupoxisomuzise.pdf
- https://site-1038970.mozfiles.com/files/1038970/gajaruvifog.pdf
- https://site-1040398.mozfiles.com/files/1040398/45218503393.pdf
- https://site-1039423.mozfiles.com/files/1039423/57704495750.pdf
- https://cdn.shopify.com/s/files/1/0500/1858/2678/files/87155372665.pdf
- https://cdn.shopify.com/s/files/1/0481/2026/6915/files/large_cooking_pots_walmart.pdf
- https://cdn.shopify.com/s/files/1/0434/5646/3015/files/iron_county_jails.pdf
- https://cdn.shopify.com/s/files/1/0440/7679/4021/files/jowujatu.pdf
- https://cdn.shopify.com/s/files/1/0433/7650/9080/files/young_life_club_talk.pdf
- https://cdn.shopify.com/s/files/1/0488/3398/6725/files/65756087096.pdf
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- site-1039787.mozfiles.com
- site-1041378.mozfiles.com
- site-1040326.mozfiles.com
- site-1039301.mozfiles.com
- cdn.shopify.com
- site-1043034.mozfiles.com
- site-1043195.mozfiles.com
- site-1038970.mozfiles.com
- site-1040398.mozfiles.com
- site-1039423.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report