SUSPICIOUS — e3b94.pdf

SUSPICIOUS — e3b94.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 3f909e450e03b28cd91c969aeff94145a6231d76f5b7f6535adf0d4bb56abcda
• SHA-1: a5ea618cbde3a9ba41de3a46560acd203eb348d2
• MD5: b6a9c678a9aec307e0344b1f6ef52b71
• ssdeep: 768:oWgGzpDh+CitvO68xOR+twE4wf71Sa1220NAQDgFw1YlLT1iSI:oDGF9wt0sEp0a704KulViSI
• TLSH: T1C1317CF38097ED8C3A8B6F57AEA604586689C38D6133E634149877BCC4785FE6F40960
• Submitted as: e3b94.pdf
• File type: pdf · Size: 41777 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/wb?keyword=meigs%20county%20tn%20school%20calendar%202019, https://cdn-cms.f-static.net/uploads/4387224/normal_5f9066c298006.pdf, https://cdn-cms.f-static.net/uploads/4366377/normal_5f8b213d919d5.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/wb?keyword=meigs%20county%20tn%20school%20calendar%202019
• https://s3.amazonaws.com/patotale/railway_appointment_letter_format.pdf
• https://s3.amazonaws.com/vufupu/13721435847.pdf
• https://cdn-cms.f-static.net/uploads/4387224/normal_5f9066c298006.pdf
• https://s3.amazonaws.com/falevi/xavozaxago.pdf
• https://s3.amazonaws.com/subud/84796287886.pdf
• https://s3.amazonaws.com/fasanag/application_software.pdf
• https://s3.amazonaws.com/kezemiradigu/community_music_schools_nyc.pdf
• https://cdn-cms.f-static.net/uploads/4366377/normal_5f8b213d919d5.pdf
• https://s3.amazonaws.com/zaxawetawupo/vipikogaworerilupatokodof.pdf
• https://s3.amazonaws.com/dixaleko/lazijoxusipado.pdf
• https://s3.amazonaws.com/bivanud/37463336764.pdf
• https://jelamiwigu.weebly.com/uploads/1/3/1/3/131382248/dogurajamogipu.pdf
• https://pelixenebedevo.weebly.com/uploads/1/3/4/3/134338689/tarulumonigike.pdf
• https://cdn-cms.f-static.net/uploads/4379380/normal_5f97e6a168285.pdf
• https://s3.amazonaws.com/dazinibonofobi/38397849856.pdf
• https://s3.amazonaws.com/wuniku/92430460009.pdf
• https://s3.amazonaws.com/xakapudakadu/watch_frozen_online_free_streaming.pdf
• https://cdn-cms.f-static.net/uploads/4366959/normal_5f8b59a8d5e74.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• s3.amazonaws.com
• cdn-cms.f-static.net
• jelamiwigu.weebly.com
• pelixenebedevo.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report