SUSPICIOUS — 12a5685dc.pdf
SUSPICIOUS — 12a5685dc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
03d148a1a3ac66bd16c049e54927f51b22b4ae642de7534a041357f975b974a2 - SHA-1:
0f25bc874021b58c425764c7bbd88f8e6026fc25 - MD5:
7f2018f49f1332f0af28d4deec761695 - ssdeep:
768:MGgGzpDsp+KedTYNRktW+x91NKBxLxmt8C69ZI28w9uv:2GFAp+CPktWa+tI8CwZI28w9uv - TLSH:
T1D4328DF350A7ED4C7A8FBB17AEA6006A644AD6CC61329654488C3B3CD07C6FD7E01961 - Submitted as: 12a5685dc.pdf
- File type: pdf · Size: 45151 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/f610e960-6c52-4e54-9773-38e918b06f0f/60810167989.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=financial%20accounting%20tools%20for%20business%20decision%20making%207th%20edition%20wileyplus, https://cdn-cms.f-static.net/uploads/4365598/normal_5f87428b4077f.pdf, https://cdn-cms.f-static.net/uploads/4365639/normal_5f8705c80543d.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=financial%20accounting%20tools%20for%20business%20decision%20making%207th%20edition%20wileyplus
- https://cdn-cms.f-static.net/uploads/4365598/normal_5f87428b4077f.pdf
- https://cdn-cms.f-static.net/uploads/4365639/normal_5f8705c80543d.pdf
- https://cdn-cms.f-static.net/uploads/4365627/normal_5f87656a60b5d.pdf
- https://site-1043172.mozfiles.com/files/1043172/volebowinezarotum.pdf
- https://site-1039129.mozfiles.com/files/1039129/dafosutazezeruda.pdf
- https://uploads.strikinglycdn.com/files/f3f769ea-15fc-4861-a4fd-ad6160a9066b/zizupatipikovajexop.pdf
- https://uploads.strikinglycdn.com/files/af6979f7-b0eb-4694-9e97-befad6456325/6768146251.pdf
- https://uploads.strikinglycdn.com/files/a3c26d4e-f8ac-4794-a6ed-319775e434c1/varekekagumo.pdf
- https://uploads.strikinglycdn.com/files/f610e960-6c52-4e54-9773-38e918b06f0f/60810167989.pdf
- https://uploads.strikinglycdn.com/files/e798e4fd-894a-4b34-945c-5cd9b6448b16/mulazonapo.pdf
- https://talapilodegopez.weebly.com/uploads/1/3/0/9/130969507/29a01f541f658.pdf
- https://pavowojavujide.weebly.com/uploads/1/3/1/3/131398322/5858400.pdf
- https://mupibidegupek.weebly.com/uploads/1/3/0/8/130874042/8331384.pdf
- https://site-1041768.mozfiles.com/files/1041768/xiriwowekurutilawozewoj.pdf
- https://site-1042733.mozfiles.com/files/1042733/lamuxofifezotakixabigotaj.pdf
- https://site-1040974.mozfiles.com/files/1040974/64900361790.pdf
- https://site-1039624.mozfiles.com/files/1039624/vexivuziwilalixutegalazek.pdf
- https://site-1036907.mozfiles.com/files/1036907/33473772278.pdf
- https://site-1037916.mozfiles.com/files/1037916/63815739997.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- site-1043172.mozfiles.com
- site-1039129.mozfiles.com
- uploads.strikinglycdn.com
- talapilodegopez.weebly.com
- pavowojavujide.weebly.com
- mupibidegupek.weebly.com
- site-1041768.mozfiles.com
- site-1042733.mozfiles.com
- site-1040974.mozfiles.com
- site-1039624.mozfiles.com
- site-1036907.mozfiles.com
- site-1037916.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report