SUSPICIOUS — 63598278118.pdf

SUSPICIOUS — 63598278118.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 1e4c67a09f8759c67af4e43df1b5c3989d11179adf932f4acd1271663103156f
• SHA-1: a84a4e7c86f66c63efc527841a9afbbdcff86a0f
• MD5: c5531d38b5362bc94cf2755c63f8b343
• ssdeep: 768:NgGzpD7pQihpiu/+N7zOprj7bR8jXqzA4HwVONhn6bJm6ua1gDY:uGFPpg2prjJ8jX08OLEm6u8gDY
• TLSH: T15632AEF31057ED8C76876B83AEA61699604AC68D603397B049983B7CD1B87BD7F00970
• Submitted as: 63598278118.pdf
• File type: pdf · Size: 43951 bytes
• Verdict: suspicious (44/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=do+sonho+ip+dirigir, https://site-1039674.mozfiles.com/files/1039674/62159057170.pdf, https://site-1038749.mozfiles.com/files/1038749/94086084104.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/strik?keyword=do+sonho+ip+dirigir
• https://site-1039674.mozfiles.com/files/1039674/62159057170.pdf
• https://site-1038749.mozfiles.com/files/1038749/94086084104.pdf
• https://site-1037203.mozfiles.com/files/1037203/vumomikesip.pdf
• https://site-1037101.mozfiles.com/files/1037101/16125352481.pdf
• https://site-1036693.mozfiles.com/files/1036693/sokawilokire.pdf
• https://site-1037274.mozfiles.com/files/1037274/15800380357.pdf
• https://site-1042549.mozfiles.com/files/1042549/79595913906.pdf
• https://site-1040568.mozfiles.com/files/1040568/vibadebuko.pdf
• https://site-1040036.mozfiles.com/files/1040036/kefemekawis.pdf
• https://site-1036945.mozfiles.com/files/1036945/88049054978.pdf
• https://cdn.shopify.com/s/files/1/0483/3266/9091/files/saddle_brook_high_school_football.pdf
• https://cdn.shopify.com/s/files/1/0486/5392/6558/files/koxupupujenukutobunerego.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• site-1039674.mozfiles.com
• site-1038749.mozfiles.com
• site-1037203.mozfiles.com
• site-1037101.mozfiles.com
• site-1036693.mozfiles.com
• site-1037274.mozfiles.com
• site-1042549.mozfiles.com
• site-1040568.mozfiles.com
• site-1040036.mozfiles.com
• site-1036945.mozfiles.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report