SUSPICIOUS — jibifovu_dejod_rutixolivikivo_fumezix.pdf
SUSPICIOUS — jibifovu_dejod_rutixolivikivo_fumezix.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
da7b7b77ed83f8372c6944e468fef5f7d6b6760364e28631425b8a05a4951f42 - SHA-1:
6ecf6316a100eba816cbd7931c02ead0df2f6ebf - MD5:
9b561c7f85aa11746308bfe3e3981889 - ssdeep:
768:QgGzpDup9arofO7J3kv4uFjwM4aUPwE4sn4ioK2ypi2s7nwL4L:9GFape9x4snPpxs7nwL4L - TLSH:
T161306CF31097ED8D7E876F53ACAB11A6608AC389A1339B90589C772DC47C2AD7F10461 - Submitted as: jibifovu_dejod_rutixolivikivo_fumezix.pdf
- File type: pdf · Size: 36194 bytes
- Verdict: suspicious (35/100)
Detections (1 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=modal%20verbs%20intermediate%20exercise%20pdf, https://cdn-cms.f-static.net/uploads/4389370/normal_5f8ec0135e75b.pdf, https://cdn-cms.f-static.net/uploads/4388424/normal_5f8fb76d0ed24.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=modal%20verbs%20intermediate%20exercise%20pdf
- https://cdn-cms.f-static.net/uploads/4389370/normal_5f8ec0135e75b.pdf
- https://cdn-cms.f-static.net/uploads/4388424/normal_5f8fb76d0ed24.pdf
- https://cdn-cms.f-static.net/uploads/4389370/normal_5f95fda62857f.pdf
- https://uploads.strikinglycdn.com/files/160d07a1-4e7c-4002-ad26-b14d2aa0d9ca/66912986789.pdf
- https://uploads.strikinglycdn.com/files/f4ef6dd6-1b0d-4c13-bfab-2654d684a23f/avatar_full_movie_free_subtitles.pdf
- https://uploads.strikinglycdn.com/files/2f0a6d06-5c32-4853-ae8b-2eca9b51f933/tarolaz.pdf
- https://cdn-cms.f-static.net/uploads/4377114/normal_5f8a0758dadc3.pdf
- https://cdn-cms.f-static.net/uploads/4368242/normal_5f8d8017f0810.pdf
- https://cdn-cms.f-static.net/uploads/4391915/normal_5f956680cc135.pdf
- https://cdn-cms.f-static.net/uploads/4367287/normal_5f8c7b97ca338.pdf
- https://cdn.shopify.com/s/files/1/0437/2670/0696/files/kazebig.pdf
- https://cdn.shopify.com/s/files/1/0498/4376/5415/files/najivedik.pdf
- https://cdn.shopify.com/s/files/1/0493/7534/6847/files/multimedia_computing_gerald_friedland.pdf
- https://cdn-cms.f-static.net/uploads/4368474/normal_5f879bc022fc6.pdf
- https://cdn-cms.f-static.net/uploads/4369185/normal_5f8bca52aa35f.pdf
- https://cdn-cms.f-static.net/uploads/4366375/normal_5f8e112ba5bb2.pdf
- https://cdn-cms.f-static.net/uploads/4366027/normal_5f8e4f900e733.pdf
- https://cdn-cms.f-static.net/uploads/4377936/normal_5f8bd16c5c5d8.pdf
- https://s3.amazonaws.com/felasorarabipis/sojomiwotufosopaxadi.pdf
- https://s3.amazonaws.com/wuniku/30516440518.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report