SUSPICIOUS — bemif.pdf
SUSPICIOUS — bemif.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
f64e251a27f5205d43d8c27b07047e7e40904f6fbab4e311790dba22dfd047dd - SHA-1:
1eddd8a1e6ab9e344f6e83f8391d6aa65aae6ae5 - MD5:
146a6f44f2d666773ed14e3433e11372 - ssdeep:
768:jgGzpDk0R5fYDKPB8MdG1TgaJ0u+Y+l65sAkBPsvFeMRbUhNWxv1V8:cGFo0OMI5sAkBPs91zv1V8 - TLSH:
T12F305CF310ABDC8C7A8BDF13ADBB25695588D74DA2339B90048C672C94BC6BD6F11850 - Submitted as: bemif.pdf
- File type: pdf · Size: 37232 bytes
- Verdict: suspicious (35/100)
Detections (1 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=circulatory%20system%20worksheets%20doc, https://rimesozarabef.weebly.com/uploads/1/3/1/6/131607712/4377800.pdf, https://jewajufigojoxi.weebly.com/uploads/1/3/1/4/131438211/xusati.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=circulatory%20system%20worksheets%20doc
- https://s3.amazonaws.com/xanebavifamopez/warrior_cats_bramblestar_s_storm.pdf
- https://s3.amazonaws.com/rizezobabub/sefumuxubugines.pdf
- https://s3.amazonaws.com/mupukesunobaga/verbes_etre_et_avoir_au_futur_exercices.pdf
- https://rimesozarabef.weebly.com/uploads/1/3/1/6/131607712/4377800.pdf
- https://jewajufigojoxi.weebly.com/uploads/1/3/1/4/131438211/xusati.pdf
- https://molisemopum.weebly.com/uploads/1/3/1/4/131437834/112cf8ce.pdf
- https://cdn-cms.f-static.net/uploads/4366028/normal_5f90ef6798d5d.pdf
- https://cdn-cms.f-static.net/uploads/4365576/normal_5f8f96a73f1ac.pdf
- https://cdn-cms.f-static.net/uploads/4378641/normal_5f8d393a86fec.pdf
- https://cdn-cms.f-static.net/uploads/4374021/normal_5f92915b08dc2.pdf
- https://cdn-cms.f-static.net/uploads/4388413/normal_5f8f773d2d27b.pdf
- https://cdn-cms.f-static.net/uploads/4383925/normal_5f8c529a8dda0.pdf
- https://cdn-cms.f-static.net/uploads/4372378/normal_5f8ff498e7898.pdf
- https://cdn-cms.f-static.net/uploads/4387417/normal_5f8d44cc96e45.pdf
- https://cdn-cms.f-static.net/uploads/4366321/normal_5f89b8bb4251a.pdf
- https://cdn-cms.f-static.net/uploads/4409239/normal_5f938c902839b.pdf
- https://cdn-cms.f-static.net/uploads/4379849/normal_5f8d0599ef7a0.pdf
- https://cdn-cms.f-static.net/uploads/4367302/normal_5f8744ea2806d.pdf
- https://cdn-cms.f-static.net/uploads/4368485/normal_5f8d913357ad2.pdf
- https://cdn-cms.f-static.net/uploads/4382420/normal_5f9234f19b40e.pdf
- https://s3.amazonaws.com/tadovu/74574195028.pdf
- https://s3.amazonaws.com/gumegulaxi/keto_beginner_grocery_list.pdf
- https://s3.amazonaws.com/vibuvomomuv/best_reader_for_windows_7_32_bit.pdf
- https://s3.amazonaws.com/tujeviwakirawu/rocomamas_drinks_menu_2018.pdf
Embedded domains
- ggtraff.ru
- s3.amazonaws.com
- rimesozarabef.weebly.com
- jewajufigojoxi.weebly.com
- molisemopum.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report