SUSPICIOUS — d76b6fb3.pdf
SUSPICIOUS — d76b6fb3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
4da50893700b458643c46821e64db1ef73ce048bc04fe7cb48b16e67e36c0afc - SHA-1:
5b5fd6173f87b9bbfb3ab0194b870f2eb746701b - MD5:
b79aa8bfd26c9a043661b7cfa5ae9320 - ssdeep:
768:TgGzpDYpwzMIzLNjHCJUNDCsAODMYQQVqsHNpP72WZga11aVuF1QQEXrLGPpr3aL:sGFMpwz/zLxtmOgYQ6r7P51nrQ/+PFKL - TLSH:
T182338DF71157DD0CBA87AB039EEB255D9189D3485132E7A08488762DC4BC3BDBF40A61 - Submitted as: d76b6fb3.pdf
- File type: pdf · Size: 48483 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=cashew%20nut%20health%20benefits%20pdf, https://uploads.strikinglycdn.com/files/5c94e591-0a4b-4ec9-86e2-60278a85f819/wifarod.pdf, https://uploads.strikinglycdn.com/files/999c28fa-3610-4f6d-ab93-ee77f1e60be5/89704484859.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=cashew%20nut%20health%20benefits%20pdf
- https://uploads.strikinglycdn.com/files/5c94e591-0a4b-4ec9-86e2-60278a85f819/wifarod.pdf
- https://uploads.strikinglycdn.com/files/999c28fa-3610-4f6d-ab93-ee77f1e60be5/89704484859.pdf
- https://uploads.strikinglycdn.com/files/45d73ff0-a867-4f07-b8de-28e822294b9c/vepug.pdf
- https://uploads.strikinglycdn.com/files/55b2d65f-11e6-4195-89af-c75494338598/41919238560.pdf
- https://uploads.strikinglycdn.com/files/121a2df0-4bfc-4565-9d80-198c7db11c7b/luvidisugujuribuneru.pdf
- https://uploads.strikinglycdn.com/files/cdda64e8-f1e9-4681-8c19-fe7e6cdc3587/51813558219.pdf
- https://uploads.strikinglycdn.com/files/717a8c1d-8050-4a36-9239-bad52566e72a/pifareneborot.pdf
- https://uploads.strikinglycdn.com/files/29512ae0-8f2f-43d9-b410-6a76ca9e2cf5/30433038272.pdf
- https://uploads.strikinglycdn.com/files/13acc031-c020-4d95-a473-a95f561e6d99/kutanero.pdf
- https://site-1048574.mozfiles.com/files/1048574/65185750053.pdf
- https://site-1039271.mozfiles.com/files/1039271/48902528276.pdf
- https://site-1037178.mozfiles.com/files/1037178/72515237558.pdf
- https://site-1038310.mozfiles.com/files/1038310/gemisufipojabekasubesiw.pdf
- https://site-1039498.mozfiles.com/files/1039498/pekenirimub.pdf
- https://cdn-cms.f-static.net/uploads/4366365/normal_5f8851bf2fb98.pdf
- https://cdn-cms.f-static.net/uploads/4366003/normal_5f87598b3b0cc.pdf
- https://cdn-cms.f-static.net/uploads/4367311/normal_5f87c0aa0bf9f.pdf
- https://uploads.strikinglycdn.com/files/73b8b452-72e2-4feb-a9b5-1e1aac21330a/paxefa.pdf
- https://uploads.strikinglycdn.com/files/853d8f7f-af49-4d5c-a936-5c91038e9d51/bowiwifos.pdf
- https://uploads.strikinglycdn.com/files/74661df3-1237-4edb-bb71-13bd62af7515/17064769241.pdf
- https://site-1039965.mozfiles.com/files/1039965/30170669022.pdf
- https://site-1044107.mozfiles.com/files/1044107/famavixotirarajasezo.pdf
- https://site-1043855.mozfiles.com/files/1043855/konezojewuzoziniterigibu.pdf
- https://site-1039921.mozfiles.com/files/1039921/rubumanepikera.pdf
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- site-1048574.mozfiles.com
- site-1039271.mozfiles.com
- site-1037178.mozfiles.com
- site-1038310.mozfiles.com
- site-1039498.mozfiles.com
- cdn-cms.f-static.net
- site-1039965.mozfiles.com
- site-1044107.mozfiles.com
- site-1043855.mozfiles.com
- site-1039921.mozfiles.com
- site-1038492.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report