SUSPICIOUS — 5cd1fd.pdf
SUSPICIOUS — 5cd1fd.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
20a7a7212fb521aaad16728d716878bf9641a101349b7c90abe4b849194003b7 - SHA-1:
4693df032221c0e062e919db31e6548064533f79 - MD5:
859957e622d949631242bc4c1f4f82ff - ssdeep:
768:FgGzpDcpDTsXqtP6luZ2T9WCnbJrMQ4Z87qPoX8B3ZNFEuk7AiGkUcN7Dl7Hd:WGFwpUbs0bJMQxYwmEuDilPBDl7Hd - TLSH:
T172339FF71497DD4C7E869B03A9AB1559018AD2886232EBA054DC777CC4BC6FEBE00970 - Submitted as: 5cd1fd.pdf
- File type: pdf · Size: 47831 bytes
- Verdict: suspicious (58/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/8628263d-7798-438e-95ba-8f3f486b2d04/gunebijapifafejunokujasat.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=cuisinart%20grinder%20coffee%20maker%20manual, https://uploads.strikinglycdn.com/files/8628263d-7798-438e-95ba-8f3f486b2d04/gunebijapifafejunokujasat.pdf, https://uploads.strikinglycdn.com/files/5bca08f3-0538-4a2f-a185-d3bc48423a96/26341788049.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=cuisinart%20grinder%20coffee%20maker%20manual
- https://uploads.strikinglycdn.com/files/8628263d-7798-438e-95ba-8f3f486b2d04/gunebijapifafejunokujasat.pdf
- https://uploads.strikinglycdn.com/files/5bca08f3-0538-4a2f-a185-d3bc48423a96/26341788049.pdf
- https://uploads.strikinglycdn.com/files/d1c8e8f4-9bb1-4abc-8bbb-7900038e5a01/makorexotel.pdf
- https://uploads.strikinglycdn.com/files/c0581ca5-74b8-4093-9bc0-c259a9c382e8/palewas.pdf
- https://uploads.strikinglycdn.com/files/fa3704d2-7e39-4ff7-8059-39b4360f79ec/amino_acid_cheat_sheet.pdf
- https://s3.amazonaws.com/fasanag/logic_questions_in_telugu_language.pdf
- https://uploads.strikinglycdn.com/files/e1d3f0ff-420e-4c88-8a7a-89cc1cdc58f8/yahoo_mail_login_support.pdf
- https://uploads.strikinglycdn.com/files/e6ca16c4-fd89-4557-abba-0ca9c417fa9c/36634788459.pdf
- https://uploads.strikinglycdn.com/files/44c0063f-5f06-4704-8729-f1c7a136d899/gopemomumukadite.pdf
- https://uploads.strikinglycdn.com/files/8dd6a648-06b7-48b4-a243-999f46dad54f/ryse_smartglass_companion.pdf
- https://uploads.strikinglycdn.com/files/1ea74b9c-db7d-46b9-a1c3-408df40c5b9f/fairy_tail_vs_one_piece_1._1.pdf
- https://uploads.strikinglycdn.com/files/7e38c61e-bf54-45eb-b98a-48b375ca7fe4/55975775841.pdf
- https://cdn.shopify.com/s/files/1/0459/6953/9232/files/15759714695.pdf
- https://cdn.shopify.com/s/files/1/0501/0613/8787/files/92809000385.pdf
- https://cdn.shopify.com/s/files/1/0431/3910/4930/files/ferris_buellers_day_off_full_movie_download.pdf
- https://cdn.shopify.com/s/files/1/0504/1356/8150/files/best_ringtones_for_android_free.pdf
- https://cdn.shopify.com/s/files/1/0495/9633/4232/files/24299626731.pdf
- https://s3.amazonaws.com/dorobukasawituw/vicroads_medical_report.pdf
- https://s3.amazonaws.com/felasorarabipis/neonatal_sepsis_guidelines.pdf
- https://s3.amazonaws.com/fuwawibu/past_simple_and_past_continuous_story_exercises.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- s3.amazonaws.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report