SUSPICIOUS — 779695dfd2d0.pdf

SUSPICIOUS — 779695dfd2d0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 12a25ccf954ba51a929919e3924a7fb5b41570a27fa4725f7714bb635bb6e6c2
• SHA-1: 0a52bbc464f8dab68f5dc851e390c3c027143662
• MD5: 8207cfe03624712f1b0d4d1a0cc8906e
• ssdeep: 768:ngGzpDQ9K1OWHe25XZqIyJ9sfzXANoha97iLBJf3yAPXi:gGFU9K3HZqIzX9hS7iLuAPXi
• TLSH: T10C32B0F3109BDD8C7A8AA7179EAA2469514AD78C6033B76444C87B2CC0FC6FD5E14560
• Submitted as: 779695dfd2d0.pdf
• File type: pdf · Size: 46725 bytes
• Verdict: suspicious (44/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/wb?keyword=paladin%20epic%20mount%20quest%20classic, https://cdn.shopify.com/s/files/1/0430/5197/4818/files/pusoku.pdf, https://uploads.strikinglycdn.com/files/fd0a11a9-310f-4a7b-ac01-542664f3c14d/56788768801.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/wb?keyword=paladin%20epic%20mount%20quest%20classic
• https://s3.amazonaws.com/rorives/silibapalewis.pdf
• https://s3.amazonaws.com/potofaw/60094359044.pdf
• https://s3.amazonaws.com/wovitiku/38259299557.pdf
• https://cdn.shopify.com/s/files/1/0430/5197/4818/files/pusoku.pdf
• https://s3.amazonaws.com/vekodupiwarobi/54199567278.pdf
• https://s3.amazonaws.com/tujeviwakirawu/xapuxipero.pdf
• https://uploads.strikinglycdn.com/files/fd0a11a9-310f-4a7b-ac01-542664f3c14d/56788768801.pdf
• https://uploads.strikinglycdn.com/files/2f5bda7e-4640-4263-8bec-410c7d61dbc8/fumoremebes.pdf
• https://cdn.shopify.com/s/files/1/0437/6425/2821/files/paytm_app_free_download_for_android_mobile.pdf
• https://s3.amazonaws.com/jafujasiwetid/binh_minh_quan_menu_san_jose.pdf
• https://uploads.strikinglycdn.com/files/cb9de774-69b5-48ea-8178-10f85043f4cf/scorch_trials_book_cover.pdf
• https://uploads.strikinglycdn.com/files/9eb808c2-909d-4d80-b327-d46b523c7428/zoborapawigomul.pdf
• https://s3.amazonaws.com/tesotiwapax/kesirapowoxofojolewokuwur.pdf
• https://s3.amazonaws.com/datarofapakil/84845452573.pdf
• https://s3.amazonaws.com/sizadagazagaj/parent_portal_toms_river.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• s3.amazonaws.com
• cdn.shopify.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report