MALICIOUS — 1d32287.pdf
MALICIOUS — 1d32287.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
0337d9cf12d4ea57e0ee2f413b9e9095a1da954d2bb6bc973b18eb670b439eb8 - SHA-1:
2d7f285f603d1bf9ac57fad74c6e3232856eff8d - MD5:
3319b1b12ac86e83e66e680f6210223a - ssdeep:
768:SgGzpDapHQh97O7pLdEFAngMyeH48SpSmQ0hutt/PjcqHN9xVP8vs0uKSKxtdkA2:PGFOpwh9O7ZdqrqHN9xVUvs0TtdkN07W - TLSH:
T18E339EF3606BEE8C7A4B1F17AEB701A9658AC3499123D7D005C8672CD1BC9ED6F00625 - Submitted as: 1d32287.pdf
- File type: pdf · Size: 48680 bytes
- Verdict: malicious (75/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://cdn-cms.f-static.net/uploads/4366057/normal_5f871cd82c639.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://cdn-cms.f-static.net/uploads/4365649/normal_5f87055be4cf5.pdf, https://cdn-cms.f-static.net/uploads/4366057/normal_5f871cd82c639.pdf, https://cdn-cms.f-static.net/uploads/4365563/normal_5f8721ee53d5e.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cdn-cms.f-static.net/uploads/4365649/normal_5f87055be4cf5.pdf
- https://cdn-cms.f-static.net/uploads/4366057/normal_5f871cd82c639.pdf
- https://cdn-cms.f-static.net/uploads/4365563/normal_5f8721ee53d5e.pdf
- https://cdn-cms.f-static.net/uploads/4365549/normal_5f86fd81d5f4e.pdf
- https://cdn-cms.f-static.net/uploads/4366033/normal_5f8725aac5351.pdf
- https://cdn-cms.f-static.net/uploads/4366335/normal_5f8727c025cc2.pdf
- https://cdn-cms.f-static.net/uploads/4366401/normal_5f8715e59c413.pdf
- https://cdn-cms.f-static.net/uploads/4365551/normal_5f870cd8e4349.pdf
- https://cdn-cms.f-static.net/uploads/4365545/normal_5f87165a6f838.pdf
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f8700aa82a31.pdf
- https://cdn-cms.f-static.net/uploads/4366041/normal_5f87195f395f8.pdf
- https://cdn-cms.f-static.net/uploads/4366365/normal_5f870f87b77cc.pdf
- https://site-1036936.mozfiles.com/files/1036936/38836690667.pdf
- https://site-1043608.mozfiles.com/files/1043608/xuligezuva.pdf
- https://site-1043523.mozfiles.com/files/1043523/28493035006.pdf
- https://site-1038323.mozfiles.com/files/1038323/24256220412.pdf
- https://cdn-cms.f-static.net/uploads/4365639/normal_5f8707a7be270.pdf
- https://cdn-cms.f-static.net/uploads/4365547/normal_5f870bb21cee7.pdf
- https://cdn-cms.f-static.net/uploads/4365619/normal_5f87031b236ed.pdf
- https://cdn-cms.f-static.net/uploads/4366007/normal_5f86f4a4ea72c.pdf
- https://cdn-cms.f-static.net/uploads/4366402/normal_5f871d5e8c973.pdf
- https://cdn-cms.f-static.net/uploads/4365525/normal_5f8706b210b84.pdf
- https://cdn-cms.f-static.net/uploads/4365546/normal_5f8713986a1d0.pdf
- https://cdn-cms.f-static.net/uploads/4366357/normal_5f870e9526469.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- site-1036936.mozfiles.com
- site-1043608.mozfiles.com
- site-1043523.mozfiles.com
- site-1038323.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report