SUSPICIOUS — c726aa48700e.pdf
SUSPICIOUS — c726aa48700e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
61d96a0850929483d1fe4def4f272b236a180759bad8075a4cc8992a01efd14d - SHA-1:
69b82d646bec6351fa6ec1949e1293f2e3c785fb - MD5:
25eb6a9f8f2df721c5f12b0a78dde5a7 - ssdeep:
768:zgGzpDRpRgML9Gh57ix4rFBXrWQ6/7siafvMd:MGFNpvKFxrW1wxfvMd - TLSH:
T1D32F7DF310A7ED8C7AC7AB07ADAA145D608DDA4C5133A76058987A2DC4BC3BD7E40960 - Submitted as: c726aa48700e.pdf
- File type: pdf · Size: 33185 bytes
- Verdict: suspicious (35/100)
Detections (1 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=tommy%20emmanuel%20struttin, https://site-1039508.mozfiles.com/files/1039508/98441246259.pdf, https://site-1043037.mozfiles.com/files/1043037/wheel_fitment_guide_86.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=tommy%20emmanuel%20struttin
- https://site-1039508.mozfiles.com/files/1039508/98441246259.pdf
- https://site-1043037.mozfiles.com/files/1043037/wheel_fitment_guide_86.pdf
- https://site-1038454.mozfiles.com/files/1038454/6399846248.pdf
- https://site-1042992.mozfiles.com/files/1042992/ziwaz.pdf
- https://site-1043047.mozfiles.com/files/1043047/mulibe.pdf
- https://site-1039565.mozfiles.com/files/1039565/20130156844.pdf
- https://site-1043086.mozfiles.com/files/1043086/bride_and_groom_poses.pdf
- https://site-1038992.mozfiles.com/files/1038992/sezurake.pdf
- https://site-1043080.mozfiles.com/files/1043080/brother_pt_65_p-touch_label_maker_instructions.pdf
- https://cdn-cms.f-static.net/uploads/4365634/normal_5f87e9a6395db.pdf
- https://cdn-cms.f-static.net/uploads/4367004/normal_5f87623c17b03.pdf
- https://cdn-cms.f-static.net/uploads/4366949/normal_5f874edb7378a.pdf
- https://cdn-cms.f-static.net/uploads/4367632/normal_5f87d8c4d8f9a.pdf
- https://cdn-cms.f-static.net/uploads/4369323/normal_5f888b8520b7f.pdf
- https://cdn-cms.f-static.net/uploads/4366004/normal_5f875951c81b1.pdf
- https://bibeliki.weebly.com/uploads/1/3/0/7/130738572/7530641.pdf
- https://riwisasivituw.weebly.com/uploads/1/3/1/0/131070703/govosipa.pdf
- https://gusumadanu.weebly.com/uploads/1/3/2/6/132695601/womanawiwurek_dipewububexuti_tudanado.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- site-1039508.mozfiles.com
- site-1043037.mozfiles.com
- site-1038454.mozfiles.com
- site-1042992.mozfiles.com
- site-1043047.mozfiles.com
- site-1039565.mozfiles.com
- site-1043086.mozfiles.com
- site-1038992.mozfiles.com
- site-1043080.mozfiles.com
- cdn-cms.f-static.net
- bibeliki.weebly.com
- riwisasivituw.weebly.com
- gusumadanu.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report