SUSPICIOUS — 3922450.pdf
SUSPICIOUS — 3922450.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
1131e062745af3c486c9c6b2cb314f38932e18de4e714b41bf5e9b4ef38e496f - SHA-1:
84052b2374d2558b68ef7ba54c2c3acdfdfe3885 - MD5:
dd917ee776a63e5f20bb250e21edebf6 - ssdeep:
768:KgGzpDUpZSTsfo88zEz8KXSoTRDC7mnmf4nf6bXhI73KanBwvlToAIeFw5K:XGFIpZhyo1mlgnfYhIFBkToAtFw5K - TLSH:
T169319DF354ABEE8C7A878B03BDA714596489C748A137DB214488372DD8BC67CBF10961 - Submitted as: 3922450.pdf
- File type: pdf · Size: 42544 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/fc49efe1-04a7-4b23-a126-a055d84d296b/kapidewewima.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=marche%20du%20destin%20uldum, https://uploads.strikinglycdn.com/files/1d6044df-24a8-4563-b621-1bb65c1a3463/xinefozuzejijaxudetulel.pdf, https://uploads.strikinglycdn.com/files/fc49efe1-04a7-4b23-a126-a055d84d296b/kapidewewima.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=marche%20du%20destin%20uldum
- https://uploads.strikinglycdn.com/files/1d6044df-24a8-4563-b621-1bb65c1a3463/xinefozuzejijaxudetulel.pdf
- https://uploads.strikinglycdn.com/files/fc49efe1-04a7-4b23-a126-a055d84d296b/kapidewewima.pdf
- https://uploads.strikinglycdn.com/files/567190f9-bc47-4b2b-9069-f26dfd136bdb/xibeli.pdf
- https://uploads.strikinglycdn.com/files/40f24690-3dc1-4cab-b7e2-8bf47d6fe4c2/rufisadilokesopowexewowex.pdf
- https://site-1043934.mozfiles.com/files/1043934/bojeviruluxulad.pdf
- https://site-1039356.mozfiles.com/files/1039356/10080098478.pdf
- https://site-1038756.mozfiles.com/files/1038756/kaxadomujumasaxasatirojeb.pdf
- https://site-1040984.mozfiles.com/files/1040984/39323793350.pdf
- https://site-1038733.mozfiles.com/files/1038733/46875064931.pdf
- https://cdn-cms.f-static.net/uploads/4367277/normal_5f876c22ef369.pdf
- https://cdn-cms.f-static.net/uploads/4366027/normal_5f86fb5ea2f0c.pdf
- https://cdn-cms.f-static.net/uploads/4368228/normal_5f876f074fb84.pdf
- https://cdn-cms.f-static.net/uploads/4368230/normal_5f876ed5499e3.pdf
- https://cdn-cms.f-static.net/uploads/4366344/normal_5f876ac751706.pdf
- https://cdn.shopify.com/s/files/1/0478/3203/9583/files/guided_meditation_letting_go_of_past_relationships.pdf
- https://cdn.shopify.com/s/files/1/0433/9374/5046/files/guwodifixuximarirutor.pdf
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/mikukinib.pdf
- https://nudojafobedem.weebly.com/uploads/1/3/1/3/131379550/6924962.pdf
- https://cdn.shopify.com/s/files/1/0429/5789/7882/files/bekumudogigorufojukenazom.pdf
- https://cdn.shopify.com/s/files/1/0434/6285/2761/files/dragon_ball_online_revelations_wiki.pdf
- https://cdn.shopify.com/s/files/1/0460/1400/5407/files/felekevojipub.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- site-1043934.mozfiles.com
- site-1039356.mozfiles.com
- site-1038756.mozfiles.com
- site-1040984.mozfiles.com
- site-1038733.mozfiles.com
- cdn-cms.f-static.net
- cdn.shopify.com
- keniwuki.weebly.com
- nudojafobedem.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report