SUSPICIOUS — 55328134416.pdf
SUSPICIOUS — 55328134416.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
62a20b84e1e8145154c941dcab20b6b9ad9ef69a1c0c6de576387a6e396fc26c - SHA-1:
52fec38a93ce5af8f03e48c47f9ff8007918f3ae - MD5:
b5be0699fb29797c0dcc0753c24f133b - ssdeep:
768:qfgGzpDseOuPHODuaCYDQbA73hKh+BVb/lL6sXmu0Bv0NSexgRhTRHINT:TGFQelCUN+BVb/lL6sXmufnshTFINT - TLSH:
T11834AEF30197DD0C768B9B036DEB202A518DD74C2232A7A489D8276CD57C7BEBE50660 - Submitted as: 55328134416.pdf
- File type: pdf · Size: 55698 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/strik?keyword=photo+editor+pro+samsung+android+pie, https://site-1043559.mozfiles.com/files/1043559/wejosexofibu.pdf, https://site-1044306.mozfiles.com/files/1044306/92792232781.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://cctraff.ru/strik?keyword=photo+editor+pro+samsung+android+pie
- https://site-1043559.mozfiles.com/files/1043559/wejosexofibu.pdf
- https://site-1044306.mozfiles.com/files/1044306/92792232781.pdf
- https://site-1048226.mozfiles.com/files/1048226/22729438216.pdf
- https://site-1036625.mozfiles.com/files/1036625/lixalidurogozevod.pdf
- https://site-1043611.mozfiles.com/files/1043611/jimob.pdf
- https://cdn.shopify.com/s/files/1/0486/8184/4886/files/nuzimuledusi.pdf
- https://cdn.shopify.com/s/files/1/0499/5013/0331/files/39093140376.pdf
- https://uploads.strikinglycdn.com/files/65d887cc-6933-45cd-abf1-ab88e6c77ade/506666020.pdf
- https://uploads.strikinglycdn.com/files/53a26027-fba6-4f4a-bb41-559e89918fbc/33872882990.pdf
- https://uploads.strikinglycdn.com/files/9fed871e-992e-4a45-aaef-5b3e7ff2af5d/roveto.pdf
- https://site-1042106.mozfiles.com/files/1042106/16315619678.pdf
- https://site-1036721.mozfiles.com/files/1036721/pifopigerewatare.pdf
- https://site-1037057.mozfiles.com/files/1037057/magidufixat.pdf
- https://site-1040354.mozfiles.com/files/1040354/54746112317.pdf
- https://site-1039583.mozfiles.com/files/1039583/jaresalomuwu.pdf
- https://site-1036907.mozfiles.com/files/1036907/37945994410.pdf
- https://site-1042838.mozfiles.com/files/1042838/labunimepikadijunigomufog.pdf
- https://site-1037884.mozfiles.com/files/1037884/80426938523.pdf
- https://site-1036821.mozfiles.com/files/1036821/89319087935.pdf
- https://site-1040443.mozfiles.com/files/1040443/nadexepemobim.pdf
- https://site-1043377.mozfiles.com/files/1043377/nifopuraja.pdf
- https://site-1044109.mozfiles.com/files/1044109/59240562890.pdf
- https://site-1039730.mozfiles.com/files/1039730/8263514310.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- site-1043559.mozfiles.com
- site-1044306.mozfiles.com
- site-1048226.mozfiles.com
- site-1036625.mozfiles.com
- site-1043611.mozfiles.com
- cdn.shopify.com
- uploads.strikinglycdn.com
- site-1042106.mozfiles.com
- site-1036721.mozfiles.com
- site-1037057.mozfiles.com
- site-1040354.mozfiles.com
- site-1039583.mozfiles.com
- site-1036907.mozfiles.com
- site-1042838.mozfiles.com
- site-1037884.mozfiles.com
- site-1036821.mozfiles.com
- site-1040443.mozfiles.com
- site-1043377.mozfiles.com
- site-1044109.mozfiles.com
- site-1039730.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report