SUSPICIOUS — pemuwim.pdf

SUSPICIOUS — pemuwim.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: ed88abb041f9b7a7687b8d46969d40a3ce6366af9ec12fd824dba50179c84b90
• SHA-1: f2faff292f524dc549c39846750969ca40740ff9
• MD5: c89c1e50c130274d0357515f1769ea1f
• ssdeep: 768:DgGzpDUI1yQe5W9kMPfdd8vv9lstB3NcwKHwLcFQlvU8Ze1BzA:8GFwyvkSfddav9l4Bmw2wE0vUzBzA
• TLSH: T17A32AEF74053EC8C7EC6AB03ADE62069904AD7887136926414D8BB6CD4FC6FDAE50871
• Submitted as: pemuwim.pdf
• File type: pdf · Size: 43251 bytes
• Verdict: suspicious (44/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/wb?keyword=topographic%20profile%20pdf, https://zuragani.weebly.com/uploads/1/3/1/4/131438510/ketipu.pdf, https://pubetisor.weebly.com/uploads/1/3/4/3/134348812/542d0fa66b43.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/wb?keyword=topographic%20profile%20pdf
• https://zuragani.weebly.com/uploads/1/3/1/4/131438510/ketipu.pdf
• https://pubetisor.weebly.com/uploads/1/3/4/3/134348812/542d0fa66b43.pdf
• https://s3.amazonaws.com/mutirexa/95933353485.pdf
• https://s3.amazonaws.com/suximawo/95775603892.pdf
• https://s3.amazonaws.com/solonebosop/consumerism_in_brave_new_world.pdf
• https://s3.amazonaws.com/laradusa/92414940083.pdf
• https://nudopimiga.weebly.com/uploads/1/3/1/0/131070212/nuxusivinujabij_vekidolivezukoj_lumuwawurafil_vogewusilakepuz.pdf
• https://s3.amazonaws.com/gotenukevepunin/19727014843.pdf
• https://tibiwurab.weebly.com/uploads/1/3/2/6/132695994/rotijorep-webuwe-netad.pdf
• https://uploads.strikinglycdn.com/files/d50bea14-ebf1-4a25-bab4-8a2dd33c0bb5/puvinogogeninitovoginoru.pdf
• https://s3.amazonaws.com/suxiweke/if_function_in_excel_2010_multiple_conditions.pdf
• https://uploads.strikinglycdn.com/files/d241bc97-d5a2-4c49-b226-6974b72f18e9/vofusop.pdf
• https://buliduxefexefux.weebly.com/uploads/1/3/1/6/131636978/tuvow-laminevub-balisimiravupa.pdf
• https://s3.amazonaws.com/pazifetanegapu/membrane_bioreactors_for_wastewater_treatment.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• zuragani.weebly.com
• pubetisor.weebly.com
• s3.amazonaws.com
• nudopimiga.weebly.com
• tibiwurab.weebly.com
• uploads.strikinglycdn.com
• buliduxefexefux.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report