SUSPICIOUS — 4328668.pdf
SUSPICIOUS — 4328668.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
19af79d8146a295de84787a119240b7c4b51e7e9ad429efa268082a577ee0fe3 - SHA-1:
71cd178201bcb8f88736e3d50953defed9a4aed6 - MD5:
09cf66a88c90d9634ccd0259834be166 - ssdeep:
768:VJgGzpDjpsAcQDZb+vWRB97L9ANNV4ZsYf+DgQIu5CsfS9msHWKhttTdyjZNN4rC:MGFPpLZsHgbmgWcTdyjZNN4rC - TLSH:
T1E8327CF350DBEC0DBE879B439DEB216A5189C38DA236D790448C662CD1BC6BD7E10960 - Submitted as: 4328668.pdf
- File type: pdf · Size: 44098 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/acea50db-35bf-4687-9232-8e29cca5e3a8/mugitaleba.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=imperfect%20verb%20endings%20spanish, https://site-1039311.mozfiles.com/files/1039311/70828025509.pdf, https://site-1041695.mozfiles.com/files/1041695/viwivavujiki.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=imperfect%20verb%20endings%20spanish
- https://site-1039311.mozfiles.com/files/1039311/70828025509.pdf
- https://site-1041695.mozfiles.com/files/1041695/viwivavujiki.pdf
- https://site-1042453.mozfiles.com/files/1042453/vuzijomudagopabasivimugu.pdf
- https://site-1039769.mozfiles.com/files/1039769/89418994026.pdf
- https://site-1041926.mozfiles.com/files/1041926/28152442647.pdf
- https://uploads.strikinglycdn.com/files/12655bab-67ee-4d0f-8ee7-6315a9f49ba1/tiniwasovinav.pdf
- https://uploads.strikinglycdn.com/files/acea50db-35bf-4687-9232-8e29cca5e3a8/mugitaleba.pdf
- https://uploads.strikinglycdn.com/files/8853e7fb-d2f0-4c50-860d-4979f3e598b2/93950403060.pdf
- https://cdn.shopify.com/s/files/1/0486/7450/4854/files/penowekesupokixizaka.pdf
- https://cdn.shopify.com/s/files/1/0266/8121/3113/files/super_smash_flash_2_cheat_codes.pdf
- https://cdn.shopify.com/s/files/1/0483/5973/5447/files/tevezegesixo.pdf
- https://cdn.shopify.com/s/files/1/0431/3595/9202/files/what_are_the_six_steps_of_programming.pdf
- https://cdn.shopify.com/s/files/1/0433/4092/3048/files/52087954688.pdf
- https://cdn-cms.f-static.net/uploads/4366389/normal_5f87520ab22f1.pdf
- https://cdn-cms.f-static.net/uploads/4366317/normal_5f873ff754b22.pdf
- https://cdn-cms.f-static.net/uploads/4365584/normal_5f86feea0dbfd.pdf
- https://cdn-cms.f-static.net/uploads/4366959/normal_5f873b92ef903.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f872b9675451.pdf
- https://cdn.shopify.com/s/files/1/0428/1470/1735/files/xujudivixige.pdf
- https://cdn.shopify.com/s/files/1/0483/0825/6923/files/semunalewabizivixufafifag.pdf
- https://cdn.shopify.com/s/files/1/0435/2406/3392/files/ludagixetojel.pdf
- https://cdn.shopify.com/s/files/1/0433/9888/9621/files/helter_skelter.pdf
- https://uploads.strikinglycdn.com/files/261f02e4-2e02-49b3-b20e-c58d052027b3/91702730052.pdf
- https://uploads.strikinglycdn.com/files/91f30cb7-968f-48bd-9427-b754ee8082d7/43000152811.pdf
Embedded domains
- gettraff.ru
- site-1039311.mozfiles.com
- site-1041695.mozfiles.com
- site-1042453.mozfiles.com
- site-1039769.mozfiles.com
- site-1041926.mozfiles.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report