SUSPICIOUS — 14cb6f7a867a.pdf
SUSPICIOUS — 14cb6f7a867a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
2d9a141535cb75c2dc54456a6dc9dfdb8600619487d4bb6a508dff44372c18ca - SHA-1:
6ed87c0ba9a0e4fb9793f7850469f6ebc5ed8110 - MD5:
dac63a7cfbfc61b17db9599d69013827 - ssdeep:
768:YgGzpDqplBzYjIPcQPACcFy9reuiSctawsygmpc93q/3KyJgMWbRX7pZub7/rSMH:1GFWpYSctEBmpcA/33FWVX7pobH4daJ - TLSH:
T125349DF710A3EC4C7A8B6F179EAB14AD648AC789B123D690548C772DD07C9FD2E00661 - Submitted as: 14cb6f7a867a.pdf
- File type: pdf · Size: 52361 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://cdn-cms.f-static.net/uploads/4366369/normal_5f876a115642f.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=y2k%20survival%20guide, https://cdn-cms.f-static.net/uploads/4366369/normal_5f876a115642f.pdf, https://cdn-cms.f-static.net/uploads/4366408/normal_5f8725c66d2bb.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=y2k%20survival%20guide
- https://cdn-cms.f-static.net/uploads/4366369/normal_5f876a115642f.pdf
- https://cdn-cms.f-static.net/uploads/4366408/normal_5f8725c66d2bb.pdf
- https://cdn-cms.f-static.net/uploads/4365635/normal_5f875293f335a.pdf
- https://cdn-cms.f-static.net/uploads/4368218/normal_5f876961cecc9.pdf
- https://cdn-cms.f-static.net/uploads/4366018/normal_5f86f82a6bac2.pdf
- https://cdn.shopify.com/s/files/1/0433/3876/0342/files/38419144133.pdf
- https://cdn.shopify.com/s/files/1/0481/7036/9175/files/gajupovibolujitopuv.pdf
- https://cdn.shopify.com/s/files/1/0434/4938/5126/files/10170397205.pdf
- https://cdn.shopify.com/s/files/1/0432/2626/7816/files/how_many_calories_in_a_california_roll_with_avocado.pdf
- https://cdn.shopify.com/s/files/1/0266/8390/0099/files/35109925726.pdf
- https://cdn.shopify.com/s/files/1/0496/6976/7325/files/motorola_mc75_handheld_manual.pdf
- https://cdn.shopify.com/s/files/1/0481/3838/7607/files/nifimaxoxotobonekora.pdf
- https://cdn-cms.f-static.net/uploads/4366622/normal_5f8768299145f.pdf
- https://cdn-cms.f-static.net/uploads/4365553/normal_5f87126d67a9d.pdf
- https://cdn-cms.f-static.net/uploads/4366367/normal_5f8741d965589.pdf
- https://cdn-cms.f-static.net/uploads/4366665/normal_5f8767d50e8ad.pdf
- https://cdn-cms.f-static.net/uploads/4365660/normal_5f870087d052c.pdf
- https://site-1038478.mozfiles.com/files/1038478/jafepuwajido.pdf
- https://site-1048226.mozfiles.com/files/1048226/konigawuloka.pdf
- https://site-1037157.mozfiles.com/files/1037157/62738317671.pdf
- https://site-1036680.mozfiles.com/files/1036680/11028339039.pdf
- https://uploads.strikinglycdn.com/files/8b833ba2-380f-428a-86bb-64ca0af2677a/26337749184.pdf
- https://uploads.strikinglycdn.com/files/c7a2938b-7744-41a0-9c92-d5d5e1c012d5/71428141685.pdf
- https://uploads.strikinglycdn.com/files/2e51f2f8-4b18-473a-9ed0-a8b47606aa22/zamituwegugo.pdf
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- site-1038478.mozfiles.com
- site-1048226.mozfiles.com
- site-1037157.mozfiles.com
- site-1036680.mozfiles.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report