SUSPICIOUS — 8112064.pdf

SUSPICIOUS — 8112064.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 2342534a3ccf15a1bfdd86c12c6e36c47698b022f7c004a188f4aeb1a2be320d
• SHA-1: 5ea882220fddb9fbcc5b7d394506bbeaaae89fc4
• MD5: ce843d5b6c61c74ec20b46f26e60898f
• ssdeep: 768:vgGzpDakRKwU4yw6tSz6TQ2PSczG83a2jCKdseOC/CFY6iqS0zA9KC9G8QFFi:YGFGkop3Sr2t7OC/CFFiqVA9KC9G8WFi
• TLSH: T109329EF350A3EE8C7AC69B079CB610596585C78C7132AB6068D87B7CC5BC6FC6E40921
• Submitted as: 8112064.pdf
• File type: pdf · Size: 46728 bytes
• Verdict: suspicious (44/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/wb?keyword=mengubah%20file%20pdf%20ke%20word%20online%20free, https://cdn.shopify.com/s/files/1/0499/3974/2878/files/sink_and_float_kindergarten_worksheets.pdf, https://cdn.shopify.com/s/files/1/0498/1689/5643/files/mtp_usb_device_driver_windows_7_android.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/wb?keyword=mengubah%20file%20pdf%20ke%20word%20online%20free
• https://cdn.shopify.com/s/files/1/0499/3974/2878/files/sink_and_float_kindergarten_worksheets.pdf
• https://cdn.shopify.com/s/files/1/0498/1689/5643/files/mtp_usb_device_driver_windows_7_android.pdf
• https://s3.amazonaws.com/xanebavifamopez/57330228757.pdf
• https://cdn.shopify.com/s/files/1/0504/8998/3136/files/tutu_helper_apk_download_english.pdf
• https://s3.amazonaws.com/fejenijovekozu/east_central_library_north_branch.pdf
• https://cdn.shopify.com/s/files/1/0497/2897/9096/files/english_grammar_summary_sheet.pdf
• https://s3.amazonaws.com/welanisowari/derivation_of_continuity_equation_in_cylindrical_coordinates.pdf
• https://s3.amazonaws.com/xanebavifamopez/36550656665.pdf
• https://s3.amazonaws.com/zepifudoxapo/causes_of_the_war_of_1812_worksheet.pdf
• https://cdn.shopify.com/s/files/1/0440/7679/4021/files/youth_in_south_africa.pdf
• https://s3.amazonaws.com/susopuzupure/xovububobaxizew.pdf
• https://cdn.shopify.com/s/files/1/0504/9919/0976/files/50157931551.pdf
• https://cdn.shopify.com/s/files/1/0439/5591/2862/files/pokemon_platinum_rom_hack.pdf
• https://vasedowazapen.weebly.com/uploads/1/3/4/3/134320052/8604e10524d.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• cdn.shopify.com
• s3.amazonaws.com
• vasedowazapen.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report