SUSPICIOUS — gasinub.pdf
SUSPICIOUS — gasinub.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
117ec43096e8545d21f2c97f76952e44b71bf0f11f4166beebe375aee7ba7dd7 - SHA-1:
22b91dcc73a61659544425bb2a0c2a8f783b8b9d - MD5:
e6d4cc8d0c4d725ab6d67e9b664ba0a6 - ssdeep:
768:3gGzpDjpu8ME599pStg6xHEf1Av9t0GcxRkGbDDAnuqnJlo3JMmpkRxv:QGFPpguGcxzbAfXo3y+kRxv - TLSH:
T1FD32ADF310A7DD8C79875793ADB702A9609DD3897222E76044D87AACD4B87BD6F10820 - Submitted as: gasinub.pdf
- File type: pdf · Size: 46310 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=exercicios%20de%20ingles%20food%20and%20drink, https://cdn-cms.f-static.net/uploads/4367310/normal_5f87b219576aa.pdf, https://cdn-cms.f-static.net/uploads/4365602/normal_5f870100ae5dc.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=exercicios%20de%20ingles%20food%20and%20drink
- https://cdn-cms.f-static.net/uploads/4367310/normal_5f87b219576aa.pdf
- https://cdn-cms.f-static.net/uploads/4365602/normal_5f870100ae5dc.pdf
- https://cdn-cms.f-static.net/uploads/4365598/normal_5f86fa28665f2.pdf
- https://cdn-cms.f-static.net/uploads/4366031/normal_5f8713bf7ac4f.pdf
- https://cdn-cms.f-static.net/uploads/4365552/normal_5f878d42c0d9e.pdf
- https://cdn-cms.f-static.net/uploads/4370263/normal_5f8816994f3f3.pdf
- https://cdn-cms.f-static.net/uploads/4367312/normal_5f87a6c2c86b4.pdf
- https://cdn-cms.f-static.net/uploads/4365525/normal_5f8736de5c633.pdf
- https://cdn-cms.f-static.net/uploads/4366984/normal_5f879b02ac7d8.pdf
- https://cdn-cms.f-static.net/uploads/4370996/normal_5f886680672bf.pdf
- https://mijisurux.weebly.com/uploads/1/3/1/0/131070147/502577.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/3532345.pdf
- https://jobubati.weebly.com/uploads/1/3/1/4/131453688/poketaralopemir.pdf
- https://uploads.strikinglycdn.com/files/eadf4e3c-84a0-4392-ab75-d6cb7c189b47/52007397010.pdf
- https://uploads.strikinglycdn.com/files/e7114aad-6d67-4408-abd7-9fb0a8a6ed35/tufujo.pdf
- https://cdn-cms.f-static.net/uploads/4371787/normal_5f88791448c0e.pdf
- https://cdn-cms.f-static.net/uploads/4366360/normal_5f872426a0f75.pdf
- https://site-1043607.mozfiles.com/files/1043607/94899537445.pdf
- https://site-1037203.mozfiles.com/files/1037203/vivolepemomukok.pdf
- https://site-1039618.mozfiles.com/files/1039618/toyota_financial_services_credit_application.pdf
- https://site-1040360.mozfiles.com/files/1040360/takezipino.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- mijisurux.weebly.com
- zoxuzuxebexot.weebly.com
- jobubati.weebly.com
- uploads.strikinglycdn.com
- site-1043607.mozfiles.com
- site-1037203.mozfiles.com
- site-1039618.mozfiles.com
- site-1040360.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report