SUSPICIOUS — 800aaf8e9.pdf
SUSPICIOUS — 800aaf8e9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
2e080d117130c2a783c364df64d3c8a2041d78d826c19cbf07b27eb889fe8b48 - SHA-1:
7056b1db3a8e93db077cf4c7d8b049c1178b1de2 - MD5:
2dd9b846ed93c725e3566ff3e0d6a75f - ssdeep:
768:OgGzpDNpI0sZbARcp48YjdnplBfA7gQsmS3Hj89lU214i4xjihCvq0VbtJ+AHuP2:rGF5ppOpcvfA7BozE14iCJvtVbDjOPrS - TLSH:
T14B329DF360A7ED5C79879B436DAB219A508AD3887232E35005DCB66CD4BC4BCAF40D61 - Submitted as: 800aaf8e9.pdf
- File type: pdf · Size: 43452 bytes
- Verdict: suspicious (58/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/d3aab0e8-1fd6-4285-ae01-530a67c75637/skid_steer_fence_post_driver.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=reflective%20communication%20pdf, https://vimiwegom.weebly.com/uploads/1/3/0/7/130775837/ripovefimutijem-dofupukud-bawujaf.pdf, https://letalisukom.weebly.com/uploads/1/3/4/3/134316231/fijakiwedu_zuwused_pejaninafifexo.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=reflective%20communication%20pdf
- https://vimiwegom.weebly.com/uploads/1/3/0/7/130775837/ripovefimutijem-dofupukud-bawujaf.pdf
- https://letalisukom.weebly.com/uploads/1/3/4/3/134316231/fijakiwedu_zuwused_pejaninafifexo.pdf
- https://zevigetadafuwun.weebly.com/uploads/1/3/0/9/130969942/d1fef4448b24de.pdf
- https://xazapadikud.weebly.com/uploads/1/3/1/8/131871762/efea5.pdf
- https://jovikuveditowe.weebly.com/uploads/1/3/0/8/130874612/5cb58f04.pdf
- https://vozunutav.weebly.com/uploads/1/3/0/9/130969695/daxasolizi.pdf
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/mikukinib.pdf
- https://zuvagenujak.weebly.com/uploads/1/3/4/4/134454716/zujuboxazugubofonexe.pdf
- https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/webokataxo_tikuze_webogenoz_pisok.pdf
- https://cdn-cms.f-static.net/uploads/4369907/normal_5f886ad231f7e.pdf
- https://cdn-cms.f-static.net/uploads/4376359/normal_5f8eee8b88e83.pdf
- https://cdn-cms.f-static.net/uploads/4367005/normal_5f876355e0d1a.pdf
- https://cdn-cms.f-static.net/uploads/4370740/normal_5f8d2b0aa4953.pdf
- https://uploads.strikinglycdn.com/files/d3aab0e8-1fd6-4285-ae01-530a67c75637/skid_steer_fence_post_driver.pdf
- https://uploads.strikinglycdn.com/files/a2598aa0-db5f-4a9f-a0f4-bf7c575c090c/future_evol_rar.pdf
- https://uploads.strikinglycdn.com/files/962bee12-ca8f-4824-8c3c-3d1c067ea1a6/vanamedariwemu.pdf
- https://cdn-cms.f-static.net/uploads/4379720/normal_5f8da76378b3f.pdf
- https://cdn-cms.f-static.net/uploads/4375884/normal_5f9234fb86478.pdf
- https://cdn-cms.f-static.net/uploads/4371248/normal_5f8b25016b2c6.pdf
- https://cdn.shopify.com/s/files/1/0438/2588/9442/files/fodedovixujejudevo.pdf
- https://cdn.shopify.com/s/files/1/0436/7125/7241/files/sodomogesodipudezivur.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- vimiwegom.weebly.com
- letalisukom.weebly.com
- zevigetadafuwun.weebly.com
- xazapadikud.weebly.com
- jovikuveditowe.weebly.com
- vozunutav.weebly.com
- keniwuki.weebly.com
- zuvagenujak.weebly.com
- moxitasa.weebly.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report