SUSPICIOUS — 1458305.pdf
SUSPICIOUS — 1458305.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
054bdf035bf303b2fc387a7b5c5048f3826cd2c46dc38dcccc59e26f9c02e6ba - SHA-1:
cb73ab371c03f8a3ddeacd012abd3224356d6d2d - MD5:
d3d1d79058cd5145b49e8b64341380fd - ssdeep:
768:FgGzpDVprJ+EIvdnPM6ohov2ir0ot7MVVaixNKWE18WXsb:WGFhprMoh02u0ot7Mj5xa8Isb - TLSH:
T15E314BF3D067EE7C6A8B5B537EA615B95C4AC24921E39370018866DFA4782AD7F10830 - Submitted as: 1458305.pdf
- File type: pdf · Size: 42780 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=exercicios%20resolvidos%20livro%20resistencia%20dos%20materiais, https://uploads.strikinglycdn.com/files/8a12cbab-7cd5-473c-864c-37707e96edf2/lefugaxig.pdf, https://uploads.strikinglycdn.com/files/527ad9eb-f8c7-4282-ad6f-15471ec21320/deworodotawugabodiza.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=exercicios%20resolvidos%20livro%20resistencia%20dos%20materiais
- https://uploads.strikinglycdn.com/files/8a12cbab-7cd5-473c-864c-37707e96edf2/lefugaxig.pdf
- https://uploads.strikinglycdn.com/files/527ad9eb-f8c7-4282-ad6f-15471ec21320/deworodotawugabodiza.pdf
- https://uploads.strikinglycdn.com/files/649398d0-b775-4615-8a3d-1abd16e5a305/fizeg.pdf
- https://uploads.strikinglycdn.com/files/23e9702e-dbda-49cf-b606-7521b9a78997/32537202598.pdf
- https://uploads.strikinglycdn.com/files/36582042-10f4-4ef5-9e4f-40571ba07148/75402587716.pdf
- https://uploads.strikinglycdn.com/files/5f8a0679-4ce6-4e97-b9e3-82f27522c6af/54254947876.pdf
- https://uploads.strikinglycdn.com/files/5b679c7c-f2dc-4403-9d1e-b26eb7d578dd/vajatepubebegodite.pdf
- https://uploads.strikinglycdn.com/files/46e94605-3e1f-430d-9eda-9c205dca92da/gumotima.pdf
- https://uploads.strikinglycdn.com/files/1a648aa0-0411-42ff-967c-d6dca03c09a7/83468194607.pdf
- https://uploads.strikinglycdn.com/files/25ed7377-9151-4f9e-9b48-6f34e477e5c7/88669926161.pdf
- https://uploads.strikinglycdn.com/files/25ede5c7-0bf2-4147-9a7c-dad41f4639d2/marunofuloximetis.pdf
- https://cdn-cms.f-static.net/uploads/4366659/normal_5f879dd5cb55e.pdf
- https://cdn-cms.f-static.net/uploads/4369315/normal_5f87ac2972652.pdf
- https://cdn-cms.f-static.net/uploads/4366343/normal_5f87875ad4501.pdf
- https://cdn-cms.f-static.net/uploads/4367631/normal_5f8747c7acfbc.pdf
- https://site-1039342.mozfiles.com/files/1039342/31735549981.pdf
- https://site-1039674.mozfiles.com/files/1039674/21673330014.pdf
- https://site-1040141.mozfiles.com/files/1040141/jubuginuzasekos.pdf
- https://site-1039924.mozfiles.com/files/1039924/zulusabofarejebefabov.pdf
- https://uploads.strikinglycdn.com/files/9e975a85-01ea-404c-95d0-572762805a54/zorebizolepurodetenune.pdf
- https://uploads.strikinglycdn.com/files/6bfc424c-acff-4873-a4f6-41c254e010a7/nagami.pdf
- https://uploads.strikinglycdn.com/files/3e3c84f5-fe71-433a-9ab4-3122fb04a108/sagujaxosogerozare.pdf
- https://uploads.strikinglycdn.com/files/4268b5db-42f0-4b2b-833e-cbf075d1ea4e/98839049125.pdf
- https://uploads.strikinglycdn.com/files/2f834d63-d638-4550-a613-b8e6b69d4f69/70246372637.pdf
Embedded domains
- ggtraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- site-1039342.mozfiles.com
- site-1039674.mozfiles.com
- site-1040141.mozfiles.com
- site-1039924.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
File paths
- d:\E2=
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report