SUSPICIOUS — 2340958.pdf
SUSPICIOUS — 2340958.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
1201338ad88bc04939004e8cc215b72441a9deb0c1e3652b66598c19ed2c4d73 - SHA-1:
f8dc0792ef66a5fa4f842622675cfd20d234eee1 - MD5:
0da598759224756167d98295f1151913 - ssdeep:
1536:OGFUp7BOYw3DmfJYXO7T67uHIXWjjh9ziN2Z:3FUp7BtWSfJYe7T6/mt9mNA - TLSH:
T1E1348EF31097DE4CBA87AF53A9AB159D95CAD7886232976048C87B2CC47C3AC7F10950 - Submitted as: 2340958.pdf
- File type: pdf · Size: 53502 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=nota%20de%20venta%20pdf, https://uploads.strikinglycdn.com/files/05d4dcc9-22b3-48b5-b1b0-cc540292bbd5/87380176762.pdf, https://uploads.strikinglycdn.com/files/f3b76ebd-986f-4622-95e1-c733d4caa951/64342216122.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=nota%20de%20venta%20pdf
- https://uploads.strikinglycdn.com/files/05d4dcc9-22b3-48b5-b1b0-cc540292bbd5/87380176762.pdf
- https://uploads.strikinglycdn.com/files/f3b76ebd-986f-4622-95e1-c733d4caa951/64342216122.pdf
- https://uploads.strikinglycdn.com/files/1ff4f2b6-a508-4137-a369-7f1c7ffb6921/62053072605.pdf
- https://uploads.strikinglycdn.com/files/5fc4973f-4918-413d-9918-60c506250d9c/87571677662.pdf
- https://uploads.strikinglycdn.com/files/2b656929-6b38-4765-afa9-e8103b7abfdd/mojedogawa.pdf
- https://site-1039547.mozfiles.com/files/1039547/sofavukuz.pdf
- https://site-1038864.mozfiles.com/files/1038864/pizulevudunuludizakumas.pdf
- https://site-1048273.mozfiles.com/files/1048273/kelebokusawagi.pdf
- https://site-1039500.mozfiles.com/files/1039500/figemevaramepuw.pdf
- https://cdn-cms.f-static.net/uploads/4367000/normal_5f8743da80cb6.pdf
- https://cdn-cms.f-static.net/uploads/4366382/normal_5f870f5c8d23f.pdf
- https://cdn-cms.f-static.net/uploads/4365606/normal_5f872bbb607ff.pdf
- https://cdn-cms.f-static.net/uploads/4367625/normal_5f882b1cc0409.pdf
- https://cdn-cms.f-static.net/uploads/4366018/normal_5f8718be2d8eb.pdf
- https://uploads.strikinglycdn.com/files/246100e6-27be-4cb4-ba31-5a63d5b1cd5f/duvojetosibesinu.pdf
- https://uploads.strikinglycdn.com/files/c6f6cc9b-6e39-47d6-bf05-32584939b4a1/lafebakonujetibadewo.pdf
- https://uploads.strikinglycdn.com/files/b87da44c-c942-4beb-b5a1-b223941f1b07/20930137545.pdf
- https://cdn-cms.f-static.net/uploads/4367311/normal_5f8765c6e009b.pdf
- https://cdn-cms.f-static.net/uploads/4369165/normal_5f87a8ffe21db.pdf
- https://cdn-cms.f-static.net/uploads/4366035/normal_5f870a1e96733.pdf
- https://cdn-cms.f-static.net/uploads/4366014/normal_5f87085e49ca9.pdf
- https://site-1038332.mozfiles.com/files/1038332/zudedovigexusarezutu.pdf
- https://site-1037230.mozfiles.com/files/1037230/78627360780.pdf
- https://site-1040771.mozfiles.com/files/1040771/39422660267.pdf
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- site-1039547.mozfiles.com
- site-1038864.mozfiles.com
- site-1048273.mozfiles.com
- site-1039500.mozfiles.com
- cdn-cms.f-static.net
- site-1038332.mozfiles.com
- site-1037230.mozfiles.com
- site-1040771.mozfiles.com
- site-1037282.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report