SUSPICIOUS — 95dd0402d.pdf
SUSPICIOUS — 95dd0402d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
27b4d9de36fc7cdf790ace3e6aec81d870f0a2e30bf6434d12968802d48231c3 - SHA-1:
7df08322dcb836b99b024fa898f85834296aac50 - MD5:
354dfd45449fb8b3a622938ba1c79f64 - ssdeep:
768:XgGzpD2p7001vJRZuTRlhFF+cLghi5Vzqnoa3eDlbu5zpIcPkOJ0E:wGFyp7001vO9Mw5IveDlKBpIcPkOJ0E - TLSH:
T129327EF34157ED8CBA8B9B07AEFB11A96146C38D7221A7544888773CC0BC5FD6E40A21 - Submitted as: 95dd0402d.pdf
- File type: pdf · Size: 45952 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=foot%20locker%20job%20application%20pdf, https://cdn-cms.f-static.net/uploads/4374976/normal_5f920b7463cd4.pdf, https://cdn-cms.f-static.net/uploads/4368975/normal_5f89b287b53e5.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=foot%20locker%20job%20application%20pdf
- https://s3.amazonaws.com/daraniwekamidir/pobojapokonibenemitege.pdf
- https://s3.amazonaws.com/fejatepudopito/yoga_poses_printable.pdf
- https://s3.amazonaws.com/wixamupelinere/que_es_normalidad_y_anormalidad_en_psicologia.pdf
- https://s3.amazonaws.com/sugaguxagu/bapogoj.pdf
- https://s3.amazonaws.com/bededuxotulapil/abandono_escolar_em_cabo_verde.pdf
- https://cdn-cms.f-static.net/uploads/4374976/normal_5f920b7463cd4.pdf
- https://cdn-cms.f-static.net/uploads/4368975/normal_5f89b287b53e5.pdf
- https://s3.amazonaws.com/jemazejodep/une_tempete_aime_cesaire_french.pdf
- https://s3.amazonaws.com/tadovu/57647066973.pdf
- https://s3.amazonaws.com/zetare/34740513886.pdf
- https://s3.amazonaws.com/susopuzupure/kiluvarumolusajawid.pdf
- https://s3.amazonaws.com/sevoga/bsc_chemistry_book_in_hindi.pdf
- https://uploads.strikinglycdn.com/files/9b6c20be-ea79-423d-8cf5-fe29e887f431/4522772175.pdf
- https://uploads.strikinglycdn.com/files/b9fa9ba3-5ed1-4450-8068-6b106aa61cf4/vengeance_demon_hunter_macros.pdf
- https://uploads.strikinglycdn.com/files/62cb0f3e-8071-45f5-9658-0403ba453b35/30131188209.pdf
- https://uploads.strikinglycdn.com/files/a63d2a64-ea46-4ce9-903c-f6e822971b5c/48901013968.pdf
- https://cdn-cms.f-static.net/uploads/4368756/normal_5f90e59bdf4d8.pdf
- https://cdn-cms.f-static.net/uploads/4382412/normal_5f8b49e27e408.pdf
- https://cdn-cms.f-static.net/uploads/4369317/normal_5f8bfa7d85822.pdf
- https://cdn-cms.f-static.net/uploads/4368489/normal_5f8c819192d6e.pdf
- https://uploads.strikinglycdn.com/files/199d1a3b-9392-4145-b650-0e4c106b3c7e/70417473550.pdf
- https://uploads.strikinglycdn.com/files/019ef504-5f66-4215-bc50-c15bbcd26a58/pufirezesusanu.pdf
- https://uploads.strikinglycdn.com/files/b948f375-de7c-4234-a4fa-67825748f7a0/3809211396.pdf
- https://uploads.strikinglycdn.com/files/b27b322f-3dfe-4e51-b822-b68225304a8d/palabras_con_prefijo_anti.pdf
Embedded domains
- cctraff.ru
- s3.amazonaws.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report