SUSPICIOUS — 86148b78b7.pdf

SUSPICIOUS — 86148b78b7.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 398e2e96dc02e2a49dc6f5786ab7bebb58921bd2781d0b49d575ef9d742d790d
• SHA-1: 9ecd8e9d9b87fe8ef6f705c0f90af4f11da41f05
• MD5: e608746aeb2ba34b10796bd4359ccaea
• ssdeep: 1536:WGFUu/gWOdyvsZzCgqYf2RuBisItpziG:vFUu/D8zdqdI0sGpb
• TLSH: T18834BFF7509BDD8C2B969B13AEB6201A1186D78C7122976054D87BBCC0BC2BD7E10E71
• Submitted as: 86148b78b7.pdf
• File type: pdf · Size: 53418 bytes
• Verdict: suspicious (44/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/wb?keyword=seneca%20middle%20school%20long%20island%20new%20york, https://cdn.shopify.com/s/files/1/0502/8446/2274/files/dadaj.pdf, https://tofejigijo.weebly.com/uploads/1/3/4/3/134312142/lorukuxiratit.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/wb?keyword=seneca%20middle%20school%20long%20island%20new%20york
• https://s3.amazonaws.com/rovotafavap/custom_skin_creator_minecraft_apk.pdf
• https://s3.amazonaws.com/minaxigevani/semezerexunolidelafod.pdf
• https://cdn.shopify.com/s/files/1/0502/8446/2274/files/dadaj.pdf
• https://tofejigijo.weebly.com/uploads/1/3/4/3/134312142/lorukuxiratit.pdf
• https://s3.amazonaws.com/bevarolimesale/causes_of_procrastination_among_students.pdf
• https://s3.amazonaws.com/sezebepit/coldplay_viva_la_vida_piano_sheet_music_free.pdf
• https://s3.amazonaws.com/pazifetanegapu/93247185226.pdf
• https://pigogokeda.weebly.com/uploads/1/3/1/8/131857695/wotagajinobuful.pdf
• https://s3.amazonaws.com/retobifulipo/buvakosevutiwinu.pdf
• https://s3.amazonaws.com/regegozumekoza/3912147111.pdf
• https://cdn-cms.f-static.net/uploads/4379377/normal_5f95af22902eb.pdf
• https://s3.amazonaws.com/dadupawo/51890142608.pdf
• https://s3.amazonaws.com/lipekipuvenuji/athens_military_coup.pdf
• https://cdn.shopify.com/s/files/1/0507/8420/7042/files/ecosystems_crossword_puzzle_answers.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• s3.amazonaws.com
• cdn.shopify.com
• tofejigijo.weebly.com
• pigogokeda.weebly.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report