SUSPICIOUS — 268cd664f25fbc.pdf
SUSPICIOUS — 268cd664f25fbc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
55184c2032bab84c742b90becace5bf520821051b0ddc3dbea0e5cfceaaa622c - SHA-1:
0da28cebd656e0577a475c134e74a2a6830dca78 - MD5:
dcfa5ebaf3bee312df2ab845860a2324 - ssdeep:
768:YgGzpD3pnIZkVtan+wOVoB3OAPoj2G+qmQymY5TMPSWD0Xw0NoJkUMK+wmtro:1GF7pnJt2G+qDym4TCSWD0nC/Memtro - TLSH:
T1A0329EF35097ED4D7B8BAB03ADAF145E508AD38C513396604898662CC2BC6ED7F109B1 - Submitted as: 268cd664f25fbc.pdf
- File type: pdf · Size: 44389 bytes
- Verdict: suspicious (58/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/814c61f0-8186-466e-89c2-00bf310d5ada/49974681973.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=head%20first%20c#%20online%20pdf, https://cdn-cms.f-static.net/uploads/4368952/normal_5f87b6e741a84.pdf, https://cdn-cms.f-static.net/uploads/4365542/normal_5f8e01d352ea5.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=head%20first%20c#%20online%20pdf
- https://cdn-cms.f-static.net/uploads/4368952/normal_5f87b6e741a84.pdf
- https://cdn-cms.f-static.net/uploads/4365542/normal_5f8e01d352ea5.pdf
- https://cdn-cms.f-static.net/uploads/4374956/normal_5f9149bb54d67.pdf
- https://s3.amazonaws.com/nopomewegobij/77542721424.pdf
- https://s3.amazonaws.com/zirojopemup/bumosidavoka.pdf
- https://uploads.strikinglycdn.com/files/814c61f0-8186-466e-89c2-00bf310d5ada/49974681973.pdf
- https://uploads.strikinglycdn.com/files/d0f6f8fc-b66c-4ba7-88b2-9669570121be/22817233050.pdf
- https://s3.amazonaws.com/zaxuledo/gipijakitevudotixig.pdf
- https://s3.amazonaws.com/xabalaru/55604262920.pdf
- https://s3.amazonaws.com/jafujasiwetid/85191036649.pdf
- https://s3.amazonaws.com/mijedusovineti/edward_snowden_book_free.pdf
- https://s3.amazonaws.com/levovod/timinizasatujifulepe.pdf
- https://s3.amazonaws.com/bizamesuwepe/health_benefits_of_carotenoids.pdf
- https://s3.amazonaws.com/kavitokolezub/47273768974.pdf
- https://s3.amazonaws.com/najubu/jovigunonukepebudakopa.pdf
- https://cdn.shopify.com/s/files/1/0493/4985/3343/files/join_twos_windows.pdf
- https://cdn.shopify.com/s/files/1/0438/2441/4882/files/apology_for_poetry_summary.pdf
- https://cdn.shopify.com/s/files/1/0497/5008/1690/files/super_mario_game_app_for_android.pdf
- https://cdn.shopify.com/s/files/1/0486/3649/3992/files/melbourne_tv_guide_freeview.pdf
- https://cdn.shopify.com/s/files/1/0268/7048/1076/files/reforma_agraria_mexico.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- s3.amazonaws.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report