SUSPICIOUS — 1018f346c6.pdf
SUSPICIOUS — 1018f346c6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
56eb3b0965fa9460f416f9c10495b61ab739f5159cc9eb41bba8f7b1aa5759fc - SHA-1:
85d76aed9bb2de08d6ed408523f00147ab91d69c - MD5:
d326eda2a556151b07574bdad07b3f5d - ssdeep:
1536:HGF0+Pnt5hffNJMxAQHcj2d1SCu2UpQHWbYvk:mF0mnJf1JMxAy1zMpQCB - TLSH:
T14736BFF311A7DE8D7A876B43AEEA10D9614AC78C3126C75094CC762CC8BC1AC7F21961 - Submitted as: 1018f346c6.pdf
- File type: pdf · Size: 64196 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/c5647502-c559-4800-b42c-ec2eade11ecc/187385225.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=parametros%20farmacocineticos%20pdf, https://uploads.strikinglycdn.com/files/22c0f4fa-122b-4b19-b84e-3c04b68655eb/7934817266.pdf, https://uploads.strikinglycdn.com/files/abddcd39-c69b-411e-a0a7-e644116d48dd/9991362619.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=parametros%20farmacocineticos%20pdf
- https://uploads.strikinglycdn.com/files/22c0f4fa-122b-4b19-b84e-3c04b68655eb/7934817266.pdf
- https://uploads.strikinglycdn.com/files/abddcd39-c69b-411e-a0a7-e644116d48dd/9991362619.pdf
- https://uploads.strikinglycdn.com/files/af1b83ee-3be8-49a6-90a0-1245e2298b8a/laxalewonoju.pdf
- https://uploads.strikinglycdn.com/files/78f02759-34ab-4bce-98fc-fba1bab6d7a4/conan_dedicated_server.pdf
- https://uploads.strikinglycdn.com/files/c5647502-c559-4800-b42c-ec2eade11ecc/187385225.pdf
- https://cdn.shopify.com/s/files/1/0458/0373/3158/files/go_math_2nd_grade_chapter_2_review_test.pdf
- https://cdn.shopify.com/s/files/1/0435/6639/9647/files/best_free_photo_collage_app_android.pdf
- https://kizuwapeputatu.weebly.com/uploads/1/3/4/3/134375201/df64c92b4a.pdf
- https://lesofetu.weebly.com/uploads/1/3/1/3/131378838/6435633.pdf
- https://sepikupi.weebly.com/uploads/1/3/0/7/130738949/5b9fb40.pdf
- https://wovasemuzusalej.weebly.com/uploads/1/3/1/6/131636629/85be1b.pdf
- https://tovozilulu.weebly.com/uploads/1/3/0/8/130873983/0da2bd8.pdf
- https://uploads.strikinglycdn.com/files/ff877b2e-c878-4709-b408-d7e364b3b501/sozexazabobimonifusor.pdf
- https://uploads.strikinglycdn.com/files/0c880c1c-6a09-4537-942b-76b2d933f719/relewopafaroxe.pdf
- https://uploads.strikinglycdn.com/files/db682b81-0f6a-4de4-a5ff-64ac01ac888e/33072754626.pdf
- https://uploads.strikinglycdn.com/files/7d106b27-afef-41b9-b283-18834cdcad97/kokemixafazekikupo.pdf
- https://uploads.strikinglycdn.com/files/2b750f04-0c13-4d7b-ae3c-d7c0cca26087/vilojatiwewo.pdf
- https://cdn-cms.f-static.net/uploads/4368747/normal_5f89736536b8e.pdf
- https://cdn-cms.f-static.net/uploads/4383917/normal_5f926f7797ed9.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- kizuwapeputatu.weebly.com
- lesofetu.weebly.com
- sepikupi.weebly.com
- wovasemuzusalej.weebly.com
- tovozilulu.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report