SUSPICIOUS — 7591424.pdf
SUSPICIOUS — 7591424.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
0d2f222e6b2081ae6e3690e28a05b4656c53aa8008d3f71a201c279e538145d3 - SHA-1:
f44849d8c166236fa63959bbb6a238b52cb9e835 - MD5:
4f7d01032503708d621a3b85214a7594 - ssdeep:
768:QlwgGzpD5pXYXx5gClf13lUNguKeefIbiEbZCX81jUPNHyxv+JnmI861j/cgvoCY:KdGFdpXEUGnuKeew+EtM81jQYxv+dmIq - TLSH:
T1C232AFF3409BEC8D7E8A9B439EB71155A089C388613B936445CC776D84BCABD7E104B1 - Submitted as: 7591424.pdf
- File type: pdf · Size: 46235 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=cambridge%20grammar%20of%20english%20a%20comprehensive%20guide%20pdf%20free%20download, https://uploads.strikinglycdn.com/files/6c8aa13f-56d8-4337-8eb1-11e44b305537/gaxuzi.pdf, https://uploads.strikinglycdn.com/files/260bc034-688d-455f-8adc-0d7d83936614/xeposoviwetil.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=cambridge%20grammar%20of%20english%20a%20comprehensive%20guide%20pdf%20free%20download
- https://uploads.strikinglycdn.com/files/6c8aa13f-56d8-4337-8eb1-11e44b305537/gaxuzi.pdf
- https://uploads.strikinglycdn.com/files/260bc034-688d-455f-8adc-0d7d83936614/xeposoviwetil.pdf
- https://uploads.strikinglycdn.com/files/13ceffb8-de50-4c84-8565-1e6cc3861fbc/jalosakopubitime.pdf
- https://uploads.strikinglycdn.com/files/eac69d3b-ffcb-4f10-8018-eec565b2f266/3182973345.pdf
- https://uploads.strikinglycdn.com/files/696f7339-b789-4bf5-bbca-9cf69e201f95/33438540166.pdf
- https://site-1038932.mozfiles.com/files/1038932/37583259692.pdf
- https://site-1038547.mozfiles.com/files/1038547/8980580701.pdf
- https://tejigenunonim.weebly.com/uploads/1/3/0/8/130813632/jazapoxutob.pdf
- https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/vunud.pdf
- https://fekudumubaf.weebly.com/uploads/1/3/2/6/132681201/fejovigusugew_miposap_tonabumelasoze.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/e5bcd2697.pdf
- https://giwakatunu.weebly.com/uploads/1/3/1/4/131437107/buwuvise-tufotubamizof-wajuduzado-bolejogebikig.pdf
- https://cdn.shopify.com/s/files/1/0496/3926/0309/files/full_circle_wrestling.pdf
- https://cdn.shopify.com/s/files/1/0434/5767/5421/files/19365357659.pdf
- https://cdn.shopify.com/s/files/1/0478/9754/2822/files/48470302647.pdf
- https://cdn.shopify.com/s/files/1/0499/3096/1054/files/nidasizi.pdf
- https://uploads.strikinglycdn.com/files/1b8de5a6-c28c-4271-8f75-3204b67c5dd0/rotoki.pdf
- https://uploads.strikinglycdn.com/files/56175e3c-6bbd-4cc1-aeda-a649115780f2/nomawakanujalikugub.pdf
- https://uploads.strikinglycdn.com/files/0b5f7d7f-fb18-4482-aef3-d3ade88b4d47/23576756895.pdf
- https://uploads.strikinglycdn.com/files/7dd43f20-937e-4a34-a2f9-1ca7a442631b/bididisoderuzisexodujuku.pdf
- https://uploads.strikinglycdn.com/files/3bcfbdf7-31ed-4893-9a2e-8095bfd5d8d2/16794568297.pdf
- https://uploads.strikinglycdn.com/files/6784fb99-7d0e-46fe-8a9d-eeafa430c196/74229452627.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- site-1038932.mozfiles.com
- site-1038547.mozfiles.com
- tejigenunonim.weebly.com
- vuxozajuje.weebly.com
- fekudumubaf.weebly.com
- gimejexoxixaza.weebly.com
- giwakatunu.weebly.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report