SUSPICIOUS — ecbfe70.pdf
SUSPICIOUS — ecbfe70.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
3e57cf6c1acaed3247661ac64f9c06789a99e63352f583e5ca0e11098d70526d - SHA-1:
f17be22dc391bbf9b1bc4810cce1c79d52a18696 - MD5:
620b9c285e456b1dcc4716d923529b15 - ssdeep:
768:ngGzpD6EpPUw2SvxmZqTogzR9RWZQK71Ku9Er75ygJT/KRv7kSBjk:gGFmEpPq1KuSP5yyK9oSBjk - TLSH:
T11F319EF311A3EC4C768B9F07AEAB25594149D7486032EBA0459C676CD0BC3BDBF40621 - Submitted as: ecbfe70.pdf
- File type: pdf · Size: 42156 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=zelda%20botw%20recipe%20list, https://cdn.shopify.com/s/files/1/0484/3120/2472/files/89871605531.pdf, https://cdn.shopify.com/s/files/1/0427/6404/2396/files/sudozebuwematolev.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=zelda%20botw%20recipe%20list
- https://cdn.shopify.com/s/files/1/0484/3120/2472/files/89871605531.pdf
- https://cdn.shopify.com/s/files/1/0427/6404/2396/files/sudozebuwematolev.pdf
- https://cdn.shopify.com/s/files/1/0480/2333/9167/files/kekomuvos.pdf
- https://site-1043938.mozfiles.com/files/1043938/60380118788.pdf
- https://site-1039727.mozfiles.com/files/1039727/fapirogewol.pdf
- https://cdn-cms.f-static.net/uploads/4366008/normal_5f877881d6269.pdf
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f876b10be47c.pdf
- https://cdn-cms.f-static.net/uploads/4365608/normal_5f877130dc0c1.pdf
- https://cdn-cms.f-static.net/uploads/4366017/normal_5f87744a0b824.pdf
- https://cdn-cms.f-static.net/uploads/4366984/normal_5f87703279149.pdf
- https://cdn.shopify.com/s/files/1/0440/8583/7989/files/mapilekiparesab.pdf
- https://cdn.shopify.com/s/files/1/0497/4467/4979/files/fortnite_on_chromebook_gameplay.pdf
- https://cdn.shopify.com/s/files/1/0483/8670/3511/files/black_and_decker_dustbuster_chv1410l.pdf
- https://cdn.shopify.com/s/files/1/0482/0910/0957/files/pherazone_ultra_super_concentrated.pdf
- https://cdn.shopify.com/s/files/1/0461/8276/0601/files/nilutopaguregolulijenegux.pdf
- https://cdn.shopify.com/s/files/1/0481/0312/9252/files/famekusesifagozinisikije.pdf
- https://cdn.shopify.com/s/files/1/0483/0950/2116/files/dosov.pdf
- https://cdn.shopify.com/s/files/1/0435/9097/5647/files/black_and_decker_lst136_manual.pdf
- https://cdn.shopify.com/s/files/1/0428/7479/8247/files/card_catalog_for_sale_michigan.pdf
- https://cdn.shopify.com/s/files/1/0437/2417/7560/files/how_old_is_your_soul.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- site-1043938.mozfiles.com
- site-1039727.mozfiles.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report