SUSPICIOUS — 2996dd84c4.pdf
SUSPICIOUS — 2996dd84c4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
4a13e6d6e9c0102a12f97e3c49fec933a30da6a9177c9274513854a4302ca66a - SHA-1:
6fe2155bbccaa7ca260cef5e7c24fb7de433ed99 - MD5:
18c855b7bab7112db6a7aad5a922822e - ssdeep:
768:TbgGzpD9pAFi1JpaUQDP1xUFZiJWbLhzBHedDclZcGNa:YGFhpnAP1x/JSNBiDcncGNa - TLSH:
T1D2317DF70097EC8CBA8F5F075FAB1159A18AC74DA132A290459C672DD07CAED7F00A25 - Submitted as: 2996dd84c4.pdf
- File type: pdf · Size: 42730 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://vevejeda.weebly.com/uploads/1/3/0/7/130776099/18c46ddaf0eb7.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=compare%20and%20contrast%20transition%20words%20worksheet%20pdf, https://uploads.strikinglycdn.com/files/27c2fa3d-5405-49ad-aa41-9b3359ec44bb/jexeralogagunuzur.pdf, https://uploads.strikinglycdn.com/files/e9894f5a-af7a-4679-bcdb-62918e13c4ad/pivov.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=compare%20and%20contrast%20transition%20words%20worksheet%20pdf
- https://uploads.strikinglycdn.com/files/27c2fa3d-5405-49ad-aa41-9b3359ec44bb/jexeralogagunuzur.pdf
- https://uploads.strikinglycdn.com/files/e9894f5a-af7a-4679-bcdb-62918e13c4ad/pivov.pdf
- https://uploads.strikinglycdn.com/files/0733036f-22d8-4c78-b6ac-7b346a89e64e/kipafiwuborosogupo.pdf
- https://uploads.strikinglycdn.com/files/c21bf1a4-ab8c-455d-85f4-7a1e765bbaad/8191721942.pdf
- https://uploads.strikinglycdn.com/files/2a9634c7-bd4b-445a-ae36-1a0788b6e5d2/13907342295.pdf
- https://vevejeda.weebly.com/uploads/1/3/0/7/130776099/18c46ddaf0eb7.pdf
- https://xuwuperozaposa.weebly.com/uploads/1/3/2/3/132303395/3996995.pdf
- https://bibeliki.weebly.com/uploads/1/3/0/7/130738572/lebof-jekifugivavane.pdf
- https://vuzevarezevarot.weebly.com/uploads/1/3/0/7/130740461/4277333.pdf
- https://saxexowiki.weebly.com/uploads/1/3/0/9/130969873/99e7e1d.pdf
- https://site-1044018.mozfiles.com/files/1044018/xuxalejedoraxobebuwasob.pdf
- https://site-1039299.mozfiles.com/files/1039299/72242538483.pdf
- https://site-1040177.mozfiles.com/files/1040177/71997644375.pdf
- https://site-1042591.mozfiles.com/files/1042591/84468321214.pdf
- https://rabifupokuwu.weebly.com/uploads/1/3/1/1/131164250/3358c4ea5b.pdf
- https://biwugina.weebly.com/uploads/1/3/1/1/131163984/wamix-nepoxek-besusaze.pdf
- https://javezevefumutew.weebly.com/uploads/1/3/2/7/132740470/dopawugix-febozivelutatin.pdf
- https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/fesixukorupu.pdf
- https://vozutadisifik.weebly.com/uploads/1/3/1/4/131483249/romukara.pdf
- https://sakukavazu.weebly.com/uploads/1/3/1/3/131379729/7092909.pdf
- https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/bawap.pdf
- https://site-1036894.mozfiles.com/files/1036894/fulofedabupofedewoxem.pdf
- https://site-1038803.mozfiles.com/files/1038803/ice_skating_android_game_download.pdf
- https://site-1039346.mozfiles.com/files/1039346/92127021105.pdf
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- vevejeda.weebly.com
- xuwuperozaposa.weebly.com
- bibeliki.weebly.com
- vuzevarezevarot.weebly.com
- saxexowiki.weebly.com
- site-1044018.mozfiles.com
- site-1039299.mozfiles.com
- site-1040177.mozfiles.com
- site-1042591.mozfiles.com
- rabifupokuwu.weebly.com
- biwugina.weebly.com
- javezevefumutew.weebly.com
- jakedekokobara.weebly.com
- vozutadisifik.weebly.com
- sakukavazu.weebly.com
- jatorogerujew.weebly.com
- site-1036894.mozfiles.com
- site-1038803.mozfiles.com
- site-1039346.mozfiles.com
- site-1038783.mozfiles.com
- site-1039669.mozfiles.com
- www.w3.org
- purl.org
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report