MALICIOUS — jodedunuza.pdf

MALICIOUS — jodedunuza.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 2 of 50 detection engines flagged it.

Identification

SHA-256: ef9d3f223a7dfd16cb576c6d21291f8b8f1cb6501c9c7d1e3c8f99dcac57530a
SHA-1: bc455eb7ddc14c186afa74b8678edf4bd166e476
MD5: 775420850ef1c46ef35afba4e5a3226b
ssdeep: 768:5SgGzpDHpxL0HQ7TcQ9hv2PcQEiYREV0/a6vV4u0NYb0VIvYIzndsENtm:xGFLpwJcEV0/a6vmzNYb0VaYmdsENtm
TLSH: T1E9328EF35097EC8CBE479B03ADBB2559608AC7886133E75094887B2CD5BC6BD7E50821
Submitted as: jodedunuza.pdf
File type: pdf · Size: 44481 bytes
Verdict: malicious (70/100)

Detections (2 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Embedded network infrastructure: https://cctraff.ru/wb?keyword=lucci%20made%20for%20it%20free%20mp3%20download, https://cdn-cms.f-static.net/uploads/4365620/normal_5f87482c96da6.pdf, https://cdn-cms.f-static.net/uploads/4373016/normal_5f889e7f55204.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://cctraff.ru/wb?keyword=lucci%20made%20for%20it%20free%20mp3%20download
https://cdn-cms.f-static.net/uploads/4365620/normal_5f87482c96da6.pdf
https://cdn-cms.f-static.net/uploads/4373016/normal_5f889e7f55204.pdf
https://cdn-cms.f-static.net/uploads/4366989/normal_5f878b1980f1f.pdf
https://cdn-cms.f-static.net/uploads/4365606/normal_5f872c4ec49ca.pdf
https://site-1040884.mozfiles.com/files/1040884/lozuxilifilitugilutovog.pdf
https://site-1043603.mozfiles.com/files/1043603/52585388523.pdf
https://site-1039274.mozfiles.com/files/1039274/zefot.pdf
https://site-1039577.mozfiles.com/files/1039577/baxewobazenas.pdf
https://site-1039514.mozfiles.com/files/1039514/27354178078.pdf
https://site-1040343.mozfiles.com/files/1040343/ritevomuborapedob.pdf
https://site-1042842.mozfiles.com/files/1042842/lipufupilofilegi.pdf
https://site-1041846.mozfiles.com/files/1041846/nanekunikimerixetizu.pdf
https://site-1039421.mozfiles.com/files/1039421/81432199825.pdf
https://cdn.shopify.com/s/files/1/0498/2092/6107/files/bufegisutom.pdf
https://cdn.shopify.com/s/files/1/0498/6801/3723/files/29861809072.pdf
https://cdn.shopify.com/s/files/1/0435/3464/7445/files/german_christmas_pyramids_for_sale.pdf
https://cdn.shopify.com/s/files/1/0500/4846/7094/files/riverejoligofekoru.pdf
https://cdn.shopify.com/s/files/1/0464/5129/4376/files/boxunob.pdf
https://cdn.shopify.com/s/files/1/0435/2730/7423/files/what_kind_of_spell_is_flipendo_harry_potter.pdf
https://tavumake.weebly.com/uploads/1/3/2/7/132740551/peparaximezur.pdf
https://vodipewelo.weebly.com/uploads/1/3/1/6/131637384/2d454eb1ed47e2.pdf
https://jukafubu.weebly.com/uploads/1/3/0/8/130874261/9668666.pdf
https://rabugotekinevod.weebly.com/uploads/1/3/1/8/131871666/jomamusenaxitejipad.pdf
https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/gowijipomunolu_lirogub_loletakimup_rozugofekowe.pdf

Embedded domains

cctraff.ru
cdn-cms.f-static.net
site-1040884.mozfiles.com
site-1043603.mozfiles.com
site-1039274.mozfiles.com
site-1039577.mozfiles.com
site-1039514.mozfiles.com
site-1040343.mozfiles.com
site-1042842.mozfiles.com
site-1041846.mozfiles.com
site-1039421.mozfiles.com
cdn.shopify.com
tavumake.weebly.com
vodipewelo.weebly.com
jukafubu.weebly.com
rabugotekinevod.weebly.com
jatorogerujew.weebly.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report