SUSPICIOUS — effet_secondaire.pdf
SUSPICIOUS — effet_secondaire.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
22f4b1682ef23b0bc53609c1a36d3378e103eed3bc0d8bc52724bf3fde7f0687 - SHA-1:
89c56ba1b191b8ea897e6dc1d8dda0e3c678b155 - MD5:
1a292d067037f8a2e1519fe19ff94150 - ssdeep:
3072:0FESbX7pS+1HR11cZ39At1wktTpXH+IQNYqPqq/KiVgwe:sESb8ExX8tAXTRImiVgf - TLSH:
T1873BD0F31493CD4D7ECA9B53ED66016A324AC2C87127D7A1549EBE6CC0BC66D7E12880 - Submitted as: effet_secondaire.pdf
- File type: pdf · Size: 106027 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=%25D8%25AA%25D8%25B3%25D9%2584%25D9%2584+%25D8%25AC%25D9%2586%25D9%2588%25D9%2583%25D8%25B3+effet+secondaire, https://cdn-cms.f-static.net/uploads/4374002/normal_5f8e25f086d36.pdf, https://cdn-cms.f-static.net/uploads/4373517/normal_5f8caf9c695c9.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/strik?keyword=%25D8%25AA%25D8%25B3%25D9%2584%25D9%2584+%25D8%25AC%25D9%2586%25D9%2588%25D9%2583%25D8%25B3+effet+secondaire
- https://cdn-cms.f-static.net/uploads/4374002/normal_5f8e25f086d36.pdf
- https://cdn-cms.f-static.net/uploads/4373517/normal_5f8caf9c695c9.pdf
- https://cdn-cms.f-static.net/uploads/4365546/normal_5f86fc4e942f2.pdf
- https://cdn-cms.f-static.net/uploads/4375884/normal_5f89f4b1d0bbc.pdf
- https://cdn-cms.f-static.net/uploads/4367007/normal_5f884f054e6ab.pdf
- https://cdn-cms.f-static.net/uploads/4367283/normal_5f8749723f3a1.pdf
- https://cdn-cms.f-static.net/uploads/4385028/normal_5f8d57579c04c.pdf
- https://cdn-cms.f-static.net/uploads/4373004/normal_5f8889bbbd9ef.pdf
- https://cdn-cms.f-static.net/uploads/4371005/normal_5f8b5af34b6e5.pdf
- https://cdn-cms.f-static.net/uploads/4369762/normal_5f8c4f868eaec.pdf
- https://uploads.strikinglycdn.com/files/82d166cf-00ad-40d2-8db1-cf07c9e282d8/lerixuvezusagi.pdf
- https://uploads.strikinglycdn.com/files/153ef8e9-e0e9-465a-91fe-22b9ada54645/45534286724.pdf
- https://uploads.strikinglycdn.com/files/a6cbfc7c-5f6e-4c96-bd9f-86d9ed3f8ada/76153442150.pdf
- https://uploads.strikinglycdn.com/files/54378abf-bd5c-428d-bbdb-323cf0aee504/lilevoxe.pdf
- https://cdn.shopify.com/s/files/1/0500/5328/4008/files/renal_function_test_download.pdf
- https://cdn.shopify.com/s/files/1/0429/1297/2963/files/nebraska_league_soccer_schedule_fall_2018.pdf
- https://cdn.shopify.com/s/files/1/0495/6310/7480/files/mi_led_32_android.pdf
- https://cdn-cms.f-static.net/uploads/4368788/normal_5f87a4154ff78.pdf
- https://cdn-cms.f-static.net/uploads/4369763/normal_5f88556bea747.pdf
- https://cdn-cms.f-static.net/uploads/4373983/normal_5f8e6290f38f8.pdf
- https://cdn.shopify.com/s/files/1/0479/8237/9164/files/touch_vpn_premium_apk_1.4.9.pdf
- https://cdn.shopify.com/s/files/1/0501/7993/2320/files/mopunajuzezapavojifiros.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report