SUSPICIOUS — ccnp_switch_lab_manual_300-115.pdf

SUSPICIOUS — ccnp_switch_lab_manual_300-115.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 35f03a890644c49747a6e345eadb66cb0ef83032d6692ec3a29ea841993e8345
• SHA-1: fd8b9347cd577e5991c62a4a19302e3561d04c58
• MD5: 717c94d36dfcb9750539076264f8d7d7
• ssdeep: 768:ygGzpDhpK4Kf5+9JdLzkUXCexEj1hTxluQWE/+R7aAcoIqFk39796F:vGFlpr28JdWSEjfr+Mn2Fc796F
• TLSH: T1E7327CF330EFED8CA583AB03BAA7155CE186D6891161DE7044D8E76DC8782FC5E10A60
• Submitted as: ccnp_switch_lab_manual_300-115.pdf
• File type: pdf · Size: 44238 bytes
• Verdict: suspicious (44/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/pify?keyword=ccnp+switch+lab+manual+pdf+300-115, http://jogimi.lionheartgraphics.com/uploads/1/3/1/3/131384605/tebomepugut-jolajelabosuxe-kazoligu.pdf, http://files.natasha-biggs.co.uk/uploads/1/3/0/7/130738658/7629490.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/pify?keyword=ccnp+switch+lab+manual+pdf+300-115
• http://jogimi.lionheartgraphics.com/uploads/1/3/1/3/131384605/tebomepugut-jolajelabosuxe-kazoligu.pdf
• http://files.natasha-biggs.co.uk/uploads/1/3/0/7/130738658/7629490.pdf
• http://files.movingmountainsstore.com/uploads/1/3/0/7/130775958/zawasusizowud.pdf
• https://cdn.shopify.com/s/files/1/0466/2758/6213/files/68076401594.pdf
• https://cdn.shopify.com/s/files/1/0484/1970/0904/files/pogikelawoli.pdf
• https://cdn.shopify.com/s/files/1/0484/5289/4874/files/barry_season_2_episode_2_credits_song.pdf
• https://cdn.shopify.com/s/files/1/0481/7105/7319/files/wododuwujirasukorexike.pdf
• https://site-1041492.mozfiles.com/files/1041492/fobelulidixajasawo.pdf
• https://site-1043438.mozfiles.com/files/1043438/47072099967.pdf
• https://site-1038349.mozfiles.com/files/1038349/13617216401.pdf
• https://site-1038401.mozfiles.com/files/1038401/290350672.pdf
• https://uploads.strikinglycdn.com/files/3ba4618e-0d52-444e-9c8e-49af634fa088/68756672568.pdf
• https://uploads.strikinglycdn.com/files/2a93beb1-cc9a-4468-a372-e4033272281c/1478441123.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• jogimi.lionheartgraphics.com
• files.natasha-biggs.co.uk
• files.movingmountainsstore.com
• cdn.shopify.com
• site-1041492.mozfiles.com
• site-1043438.mozfiles.com
• site-1038349.mozfiles.com
• site-1038401.mozfiles.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report