SUSPICIOUS — kufigi-fotozikemidi-sitiwakif-pusenukuxe.pdf
SUSPICIOUS — kufigi-fotozikemidi-sitiwakif-pusenukuxe.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
ebc6fa4aeae2697002f50b25cc4e234f5c95a40f3d3808db65b94a9a62991836 - SHA-1:
984f68c2543c038d3530f2dfff86776308eabbc3 - MD5:
93a2ac4f3c2e68235c81912fb4d75793 - ssdeep:
768:PgGzpDJpnS/Ao67vuAM8IlcybnhWfLXm1jiASB57s5OXDO6ZoHBV:4GF9pEamM21jiAS77cOXDHCBV - TLSH:
T169315AF311A7ED4C3AC79F03AEAE255C9089DB485132A7A05498676DC47C77CBF40A60 - Submitted as: kufigi-fotozikemidi-sitiwakif-pusenukuxe.pdf
- File type: pdf · Size: 41863 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=la%20la%20land%20city%20of%20stars%20piano%20sheet, https://site-1037115.mozfiles.com/files/1037115/7242080605.pdf, https://site-1040777.mozfiles.com/files/1040777/68860658064.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=la%20la%20land%20city%20of%20stars%20piano%20sheet
- https://site-1037115.mozfiles.com/files/1037115/7242080605.pdf
- https://site-1040777.mozfiles.com/files/1040777/68860658064.pdf
- https://site-1039275.mozfiles.com/files/1039275/zavesusedufubazunoviked.pdf
- https://site-1043216.mozfiles.com/files/1043216/niraj.pdf
- https://site-1038618.mozfiles.com/files/1038618/vitibutof.pdf
- https://cdn-cms.f-static.net/uploads/4366055/normal_5f875f576a272.pdf
- https://cdn-cms.f-static.net/uploads/4366341/normal_5f877819a65fb.pdf
- https://cdn-cms.f-static.net/uploads/4366407/normal_5f8744e26e76f.pdf
- https://cdn-cms.f-static.net/uploads/4366989/normal_5f872a54844f3.pdf
- https://cdn-cms.f-static.net/uploads/4365642/normal_5f873f78097ff.pdf
- https://site-1038717.mozfiles.com/files/1038717/49212083728.pdf
- https://site-1038538.mozfiles.com/files/1038538/80854525514.pdf
- https://site-1039528.mozfiles.com/files/1039528/xazasuwurimadavepizup.pdf
- https://site-1038429.mozfiles.com/files/1038429/62948111952.pdf
- https://site-1039324.mozfiles.com/files/1039324/apache_web_server_hardening__security_guide.pdf
- https://site-1038423.mozfiles.com/files/1038423/10884781681.pdf
- https://site-1039935.mozfiles.com/files/1039935/33055095620.pdf
- https://cdn.shopify.com/s/files/1/0482/8826/8449/files/jujizijaxenoruvavedivigid.pdf
- https://cdn.shopify.com/s/files/1/0500/6026/3588/files/ap_grama_sachivalayam_syllabus_books.pdf
- https://cdn.shopify.com/s/files/1/0502/8859/1006/files/nagakavudujosizejojitamin.pdf
- https://cdn.shopify.com/s/files/1/0437/0432/0154/files/quicken_metamagic_rod_pathfinder.pdf
- https://uploads.strikinglycdn.com/files/65366ec6-685e-4fb7-bc2f-c1671d6b25fc/volodetolefabofezutela.pdf
- https://uploads.strikinglycdn.com/files/1a1aecd4-c249-4d18-8407-2669d207dd23/juvosisozegowugofibigadin.pdf
- https://uploads.strikinglycdn.com/files/b46495e0-f127-44e6-8478-0d0d3cc2d3e6/ronarufivefefanemix.pdf
Embedded domains
- gettraff.ru
- site-1037115.mozfiles.com
- site-1040777.mozfiles.com
- site-1039275.mozfiles.com
- site-1043216.mozfiles.com
- site-1038618.mozfiles.com
- cdn-cms.f-static.net
- site-1038717.mozfiles.com
- site-1038538.mozfiles.com
- site-1039528.mozfiles.com
- site-1038429.mozfiles.com
- site-1039324.mozfiles.com
- site-1038423.mozfiles.com
- site-1039935.mozfiles.com
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report