MALICIOUS — dabekako.pdf

MALICIOUS — dabekako.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 0b077d6eee5c0aef635b7466aed03c139524981b16d8920d9ff05e12fa273316
• SHA-1: 30e543cd12f3f1cdb1005eb47e7e9172f9e84ca8
• MD5: 073eab4b17368e5ad6a2c9f4f35a465c
• ssdeep: 768:ggGzpD8SS/D2LYBsRhTesMpxJhPK3vwMEPFTKY/QX3rvF0xop16ufuOakWr9:tGFwSSbxnCIMEPr/QrvCO6ufLakWr9
• TLSH: T16A328EF32497DE4C7ACB9753A5AB01211589D68CA236DB9058C877ACD4BC1BDBF108A0
• Submitted as: dabekako.pdf
• File type: pdf · Size: 44948 bytes
• Verdict: malicious (70/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://ggtraff.ru/wb?keyword=malformaciones%20de%20oido%20interno%20pdf, https://uploads.strikinglycdn.com/files/2ced909a-7fe7-4809-8c15-ea2ce0fdcc07/gopro_hero_4_session_waterproof.pdf, https://uploads.strikinglycdn.com/files/1f8a7e9f-a417-4629-80ab-74f486bc900d/fipimolugitozaputixebi.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/wb?keyword=malformaciones%20de%20oido%20interno%20pdf
• https://uploads.strikinglycdn.com/files/2ced909a-7fe7-4809-8c15-ea2ce0fdcc07/gopro_hero_4_session_waterproof.pdf
• https://uploads.strikinglycdn.com/files/1f8a7e9f-a417-4629-80ab-74f486bc900d/fipimolugitozaputixebi.pdf
• https://uploads.strikinglycdn.com/files/a87a1515-a75b-466a-aa4e-8b52f90859e2/59246973386.pdf
• https://uploads.strikinglycdn.com/files/6ccb64ef-20b9-48e2-a05b-61cfeea786d9/21895923743.pdf
• https://s3.amazonaws.com/memul/suwimuxawisomokivuzenav.pdf
• https://s3.amazonaws.com/nimuwet/33761589107.pdf
• https://s3.amazonaws.com/mizeteb/dabolazuv.pdf
• https://cdn-cms.f-static.net/uploads/4379615/normal_5f8fc2af2e064.pdf
• https://cdn-cms.f-static.net/uploads/4382617/normal_5f8c7fc47a0ce.pdf
• https://cdn.shopify.com/s/files/1/0484/5466/4342/files/65821920373.pdf
• https://cdn.shopify.com/s/files/1/0499/9928/2336/files/18895537870.pdf
• https://cdn.shopify.com/s/files/1/0434/2536/6165/files/zikedefi.pdf
• https://cdn.shopify.com/s/files/1/0428/2908/6887/files/afk_arena_chest_of_wishes_halloween.pdf
• https://cdn.shopify.com/s/files/1/0433/5573/4167/files/altus_times_tv_guide.pdf
• https://cdn.shopify.com/s/files/1/0483/0108/0731/files/verbal_analogies_test.pdf
• https://cdn-cms.f-static.net/uploads/4370309/normal_5f8c90fdc6521.pdf
• https://cdn-cms.f-static.net/uploads/4368481/normal_5f8d15788360e.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• uploads.strikinglycdn.com
• s3.amazonaws.com
• cdn-cms.f-static.net
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report