SUSPICIOUS — b006d78f45.pdf
SUSPICIOUS — b006d78f45.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
5d154580b5dbe44597ea16c96c7d79a67b921100204056f50ffa2e1119b84b6f - SHA-1:
57948973551081545c0dd3c3ce58a28a72fe4d81 - MD5:
7187bdf259d759464dbe62b3ca090bf0 - ssdeep:
768:kgGzpDxpZJM4AanR5GizaR5xsDvS01OaJ6//1ICRDJ4Is0T/xNOSgIwIn:RGFlp/n3GcUYDvTJ6HDns0NN1PwIn - TLSH:
T1FC326CF350F7EC4C7A8E6B07AEAB1559A08ED34D603A9750558C372C84BCAFE2E04911 - Submitted as: b006d78f45.pdf
- File type: pdf · Size: 44420 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=shirley%20jackson%20the%20lottery%20summary, https://cdn-cms.f-static.net/uploads/4374537/normal_5f8c211b0e5c1.pdf, https://cdn-cms.f-static.net/uploads/4388412/normal_5f8df6deeff8f.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=shirley%20jackson%20the%20lottery%20summary
- https://cdn-cms.f-static.net/uploads/4374537/normal_5f8c211b0e5c1.pdf
- https://cdn-cms.f-static.net/uploads/4388412/normal_5f8df6deeff8f.pdf
- https://cdn-cms.f-static.net/uploads/4367005/normal_5f8bb152de924.pdf
- https://cdn-cms.f-static.net/uploads/4373999/normal_5f8a17f084a91.pdf
- https://uploads.strikinglycdn.com/files/5620dbaa-1fc6-41a7-8cad-58f801de3b6d/zepepubopuwuba.pdf
- https://uploads.strikinglycdn.com/files/c8dbb5ee-198a-4f47-bc64-d4d8d6fd0ce5/lawuxemaz.pdf
- https://uploads.strikinglycdn.com/files/3f76fa01-4efb-4b82-b3e6-e6361d05f6ab/61236191303.pdf
- https://uploads.strikinglycdn.com/files/e5dad21c-902b-404e-99aa-66094a80e6cd/31460243801.pdf
- https://uploads.strikinglycdn.com/files/d3dc6a86-b33d-489c-8c17-9c0be1e7ae33/prvert_en_sortant_de_l_cole.pdf
- https://pepisukuwen.weebly.com/uploads/1/3/1/6/131606293/wodajiteguse.pdf
- https://pamaridefudeluz.weebly.com/uploads/1/3/0/7/130776324/kazinoxem_zawamazoxenufe.pdf
- https://kizekusoviwo.weebly.com/uploads/1/3/1/4/131453028/jewajiwokuwokip.pdf
- https://lagukekejase.weebly.com/uploads/1/3/0/8/130815031/kukozigedexibi.pdf
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/fuxedogibiniwuw.pdf
- https://xifobosakup.weebly.com/uploads/1/3/2/8/132815359/6193575.pdf
- https://kejedavozeve.weebly.com/uploads/1/3/1/4/131483662/sigoregiver.pdf
- https://vimiwegom.weebly.com/uploads/1/3/0/7/130775837/115497.pdf
- https://saxibodusazo.weebly.com/uploads/1/3/0/7/130740440/4cada.pdf
- https://fidevawane.weebly.com/uploads/1/3/0/8/130814252/nadekejezulal-sifudavadek-woxirug.pdf
- https://vidojibirulon.weebly.com/uploads/1/3/1/0/131070792/be870852.pdf
- https://uploads.strikinglycdn.com/files/fa438332-56cb-4724-b10c-8009a9dfdc13/75811617680.pdf
- https://uploads.strikinglycdn.com/files/34fc0682-b93b-4e89-ac2e-4e321bfa9202/3748482107.pdf
- https://uploads.strikinglycdn.com/files/e5b2cf14-103f-471e-8c61-7d4d2c915160/45398497864.pdf
- https://uploads.strikinglycdn.com/files/6b18b105-62aa-446a-87c6-d34c7d921751/20302264850.pdf
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- pepisukuwen.weebly.com
- pamaridefudeluz.weebly.com
- kizekusoviwo.weebly.com
- lagukekejase.weebly.com
- genigudepa.weebly.com
- xifobosakup.weebly.com
- kejedavozeve.weebly.com
- vimiwegom.weebly.com
- saxibodusazo.weebly.com
- fidevawane.weebly.com
- vidojibirulon.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report