SUSPICIOUS — 71731b3347bb.pdf
SUSPICIOUS — 71731b3347bb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
45b6bdcee7dae9cf207c9c93a188650fffa48b15cf5e843d215f3c2b4ba97bb5 - SHA-1:
b416a41e1d6276caa72b69c9fda1fc0501d23343 - MD5:
7fe2e2cd4dac4f759d040880ca202d6e - ssdeep:
768:ggGzpDspy7zKvNMX0XKJpO6QAE+/MlJ8hm8SWMOzhFUHuIUkky2Q:tGFQpTtWMHOIU9y2Q - TLSH:
T1AD2F6CF350A7ED4CBA8BCB13ACAB25A9644DC7496137D790458C6B2CC4BC6AC7F10454 - Submitted as: 71731b3347bb.pdf
- File type: pdf · Size: 35522 bytes
- Verdict: suspicious (35/100)
Detections (2 of 50 engines)
- Microsoft Defender: Trojan:PDF/Phish.VS!MSR
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=sheet%20metal%20joggle%20tool, https://cdn-cms.f-static.net/uploads/4366010/normal_5f873dfc890a3.pdf, https://cdn-cms.f-static.net/uploads/4366397/normal_5f8728c702414.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=sheet%20metal%20joggle%20tool
- https://cdn-cms.f-static.net/uploads/4366010/normal_5f873dfc890a3.pdf
- https://cdn-cms.f-static.net/uploads/4366397/normal_5f8728c702414.pdf
- https://cdn-cms.f-static.net/uploads/4366057/normal_5f87170d946a4.pdf
- https://cdn-cms.f-static.net/uploads/4366661/normal_5f8730d6ea58f.pdf
- https://cdn-cms.f-static.net/uploads/4365626/normal_5f873f2eab546.pdf
- https://cdn-cms.f-static.net/uploads/4366036/normal_5f873f5964702.pdf
- https://cdn-cms.f-static.net/uploads/4365542/normal_5f8706518974b.pdf
- https://cdn-cms.f-static.net/uploads/4366321/normal_5f8735963092a.pdf
- https://cdn-cms.f-static.net/uploads/4365642/normal_5f873f4a1a81a.pdf
- https://cdn-cms.f-static.net/uploads/4366003/normal_5f8734f4922e1.pdf
- https://site-1039902.mozfiles.com/files/1039902/tubiboterogetetinax.pdf
- https://site-1041865.mozfiles.com/files/1041865/tukiziwu.pdf
- https://site-1043158.mozfiles.com/files/1043158/nudafixumewu.pdf
- https://babikovinemixe.weebly.com/uploads/1/3/1/8/131856339/manofuzawidevu.pdf
- https://loguxofe.weebly.com/uploads/1/3/0/7/130775118/butujekinol.pdf
- https://juragubiv.weebly.com/uploads/1/3/0/8/130874328/rimotipa.pdf
- https://zafozudakajadev.weebly.com/uploads/1/3/0/8/130814863/kuwekewugi.pdf
- https://cdn-cms.f-static.net/uploads/4366324/normal_5f8717071aab6.pdf
- https://cdn-cms.f-static.net/uploads/4366055/normal_5f872ea97a3af.pdf
- https://cdn-cms.f-static.net/uploads/4365998/normal_5f8719c96936e.pdf
- https://cdn-cms.f-static.net/uploads/4366033/normal_5f871801126fd.pdf
- https://cdn-cms.f-static.net/uploads/4365634/normal_5f8708e1c16f3.pdf
- https://rabifupokuwu.weebly.com/uploads/1/3/1/1/131164250/8444efb68af.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/bararowujilibuwi.pdf
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- site-1039902.mozfiles.com
- site-1041865.mozfiles.com
- site-1043158.mozfiles.com
- babikovinemixe.weebly.com
- loguxofe.weebly.com
- juragubiv.weebly.com
- zafozudakajadev.weebly.com
- rabifupokuwu.weebly.com
- dutitujazekap.weebly.com
- fijojonibiw.weebly.com
- jakedekokobara.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report