SUSPICIOUS — mumeredin.pdf
SUSPICIOUS — mumeredin.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
26e8fc470275039b8bf7bad5d1cf49db245e9eb1a744991f2945fdcd12ba6ed6 - SHA-1:
676dfad90cfb193e192e98bc960b0e5db4b5b91a - MD5:
ed7dd35d4172b460e4092befe4da8c42 - ssdeep:
1536:fGF0xHTAhi6qaHcnJoUnvNl4CKGdOJ7c6nwi1u7vXrp+2f/yJ2Wg2JQG4gv:OF058Y6qyUJrT4CNdOJPnHuLXrp+2f/o - TLSH:
T11D37D0F3519BED4C7A8BE7036AA61498A455C6882032C760C5D8BB2CC9BC7FD6D10E71 - Submitted as: mumeredin.pdf
- File type: pdf · Size: 75335 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/c22aebcd-4286-4c13-a514-caa65c11f886/pictionary_ideas.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=pre%20colonial%20history%20of%20zimbabwe%20pdf, https://uploads.strikinglycdn.com/files/c22aebcd-4286-4c13-a514-caa65c11f886/pictionary_ideas.pdf, https://uploads.strikinglycdn.com/files/b3cbe1d0-8ee0-42c0-ab3f-9d26c4ebb461/contrapuntal_imperfect_authentic_cadence.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=pre%20colonial%20history%20of%20zimbabwe%20pdf
- https://uploads.strikinglycdn.com/files/c22aebcd-4286-4c13-a514-caa65c11f886/pictionary_ideas.pdf
- https://uploads.strikinglycdn.com/files/b3cbe1d0-8ee0-42c0-ab3f-9d26c4ebb461/contrapuntal_imperfect_authentic_cadence.pdf
- https://uploads.strikinglycdn.com/files/1099e5ef-671d-44f9-80b4-53cb5e3a830f/xewid.pdf
- https://cdn-cms.f-static.net/uploads/4423452/normal_5f994cb61f3f2.pdf
- https://cdn.shopify.com/s/files/1/0478/9026/8326/files/61470521312.pdf
- https://uploads.strikinglycdn.com/files/f9cf3979-c7b4-4cd9-94b3-c0519e3441cd/83174339592.pdf
- https://uploads.strikinglycdn.com/files/cf44ca90-e15d-41b9-a783-5a8007a99e66/padaweze.pdf
- https://uploads.strikinglycdn.com/files/ffc7c6e1-3338-4583-a950-a88f2d2bed18/comptia_it_fundamentals_study_guide_free.pdf
- https://cdn-cms.f-static.net/uploads/4375095/normal_5f8e121c4df26.pdf
- https://cdn.shopify.com/s/files/1/0430/0354/3715/files/zedomubojesosomowosupiw.pdf
- https://cdn.shopify.com/s/files/1/0497/4755/8563/files/7th_wedding_anniversary_gifts_uk_copper.pdf
- https://uploads.strikinglycdn.com/files/85f81e46-e292-4180-8824-3069d51d7c37/organic_chemistry_carey_9th_edition_solutions_manual.pdf
- https://uploads.strikinglycdn.com/files/9709ca34-99b6-43a5-908f-ee6d2486c417/zodojipag.pdf
- https://uploads.strikinglycdn.com/files/70fe1299-982b-45df-8380-2f573d5a2df9/32824459742.pdf
- https://uploads.strikinglycdn.com/files/a9de2503-ede2-453c-b89c-54a2fd9654ab/kojinunawuzigagapigi.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report