SUSPICIOUS — issue_preclusion_vs_claim_preclusion.pdf
SUSPICIOUS — issue_preclusion_vs_claim_preclusion.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
340fdcfd2e3a4237534ccadf9b8e2b84c5ed284133d7d1a540f7719bad30a177 - SHA-1:
918332496bdb07b341f4b63792835e13f0f5c4ca - MD5:
f2f84b20063b5e1fe8beaabfadaafaac - ssdeep:
768:6gGzpDHp03oIDwrk3aNwCgZkeBPKSlSJOX78h9HQnGeyTaPwISuUUArWSANRw2x4:nGFzpA8hLTa5SuV4FUgPTaZ1MNxYLIZ - TLSH:
T1C5329EF358A7ED4D7A879F13ADAB26A55149C788A137D790088D272CC8BC57CBF20811 - Submitted as: issue_preclusion_vs_claim_preclusion.pdf
- File type: pdf · Size: 44753 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/strik?keyword=issue+preclusion+vs+claim+preclusion, https://cdn.shopify.com/s/files/1/0486/0470/9029/files/swtor_sentinel_build_2020.pdf, https://cdn.shopify.com/s/files/1/0485/8137/8208/files/tense_formula_chart_in_gujarati.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/strik?keyword=issue+preclusion+vs+claim+preclusion
- https://cdn.shopify.com/s/files/1/0486/0470/9029/files/swtor_sentinel_build_2020.pdf
- https://cdn.shopify.com/s/files/1/0485/8137/8208/files/tense_formula_chart_in_gujarati.pdf
- https://cdn.shopify.com/s/files/1/0436/4396/1494/files/vuvurabawaseg.pdf
- https://cdn.shopify.com/s/files/1/0266/8586/6167/files/hp_proliant_dl380_g5_maintenance_manual.pdf
- https://cdn.shopify.com/s/files/1/0468/1151/2986/files/total_warhammer_ritual_answers.pdf
- https://cdn.shopify.com/s/files/1/0461/9803/0485/files/gixafejamugevodupisab.pdf
- https://cdn.shopify.com/s/files/1/0496/1271/8233/files/xikurejiragekat.pdf
- https://cdn.shopify.com/s/files/1/0430/5390/8117/files/maple_chase_thermostat_replacement.pdf
- https://cdn.shopify.com/s/files/1/0434/1838/6588/files/free_download_ebooks_epub.pdf
- https://cdn-cms.f-static.net/uploads/4368237/normal_5f8803e53f8e1.pdf
- https://cdn-cms.f-static.net/uploads/4375705/normal_5f8b9df7230f8.pdf
- https://cdn-cms.f-static.net/uploads/4374199/normal_5f89d3b155cd2.pdf
- https://cdn-cms.f-static.net/uploads/4368487/normal_5f87751a49b73.pdf
- https://cdn-cms.f-static.net/uploads/4372987/normal_5f898fca88c32.pdf
- https://cdn-cms.f-static.net/uploads/4366063/normal_5f8a498df3f3a.pdf
- https://cdn-cms.f-static.net/uploads/4379960/normal_5f8bea0d42045.pdf
- https://cdn-cms.f-static.net/uploads/4365660/normal_5f8b976ae28bf.pdf
- https://cdn-cms.f-static.net/uploads/4380068/normal_5f8b72bd01dbf.pdf
- https://cdn-cms.f-static.net/uploads/4365589/normal_5f87544d1bb92.pdf
- https://cdn-cms.f-static.net/uploads/4383138/normal_5f8bb02a59bc7.pdf
- https://cdn-cms.f-static.net/uploads/4367938/normal_5f8b5960c47b3.pdf
- https://cdn-cms.f-static.net/uploads/4374983/normal_5f8938dfb7857.pdf
- https://cdn-cms.f-static.net/uploads/4367927/normal_5f87a2a823574.pdf
- https://cdn-cms.f-static.net/uploads/4369191/normal_5f8a82312892d.pdf
Embedded domains
- cctraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report