SUSPICIOUS — 3341241.pdf
SUSPICIOUS — 3341241.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
667ffde8bc541b5d8ae49f4eaafe0920e0e5fb8fed9b0fa2643cf400c16e0f73 - SHA-1:
5aee72a13de184d3bf350121a4335945a151a8df - MD5:
87fe2300c8bb1beb9ebffbbdab51e0ab - ssdeep:
1536:eGF7pkV1VKCX5kMk9EP1/s0ix1NTwpxFCoEKr954Bj3DV+zAlXjn:HF7p0lkMUEJYSaop95qjTszIj - TLSH:
T12138DFF31097EC0CB64B9F27ADAA2089B546E78D1137E6A448CD272CD47C2BE3E10564 - Submitted as: 3341241.pdf
- File type: pdf · Size: 81457 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=advanced%20accounting%20guerrero%20solutio, https://cdn-cms.f-static.net/uploads/4366374/normal_5f8785f50c18b.pdf, https://cdn-cms.f-static.net/uploads/4367631/normal_5f8774e475a45.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=advanced%20accounting%20guerrero%20solutio
- https://cdn-cms.f-static.net/uploads/4366374/normal_5f8785f50c18b.pdf
- https://cdn-cms.f-static.net/uploads/4367631/normal_5f8774e475a45.pdf
- https://cdn-cms.f-static.net/uploads/4365545/normal_5f876a6015c02.pdf
- https://cdn-cms.f-static.net/uploads/4365563/normal_5f871a5a775e5.pdf
- https://cdn-cms.f-static.net/uploads/4368782/normal_5f87d7f7e8e47.pdf
- https://site-1039847.mozfiles.com/files/1039847/vesari.pdf
- https://site-1040213.mozfiles.com/files/1040213/zuguburipudefunavo.pdf
- https://site-1039833.mozfiles.com/files/1039833/40094726162.pdf
- https://site-1042199.mozfiles.com/files/1042199/66020257402.pdf
- https://cdn-cms.f-static.net/uploads/4365608/normal_5f874e2cc908d.pdf
- https://cdn-cms.f-static.net/uploads/4368249/normal_5f87642e7a847.pdf
- https://cdn-cms.f-static.net/uploads/4366055/normal_5f872d8672669.pdf
- https://cdn-cms.f-static.net/uploads/4367313/normal_5f87764647963.pdf
- https://site-1039800.mozfiles.com/files/1039800/lokixusirewibamasoti.pdf
- https://site-1036786.mozfiles.com/files/1036786/gojemujudosusogefuralegem.pdf
- https://site-1039391.mozfiles.com/files/1039391/54945041699.pdf
- https://site-1036835.mozfiles.com/files/1036835/wagizelonesegevuwopami.pdf
- https://site-1037114.mozfiles.com/files/1037114/92884549443.pdf
- https://site-1037215.mozfiles.com/files/1037215/49653102721.pdf
- https://site-1038884.mozfiles.com/files/1038884/dufavogarel.pdf
- https://cdn.shopify.com/s/files/1/0494/6765/4311/files/terraria_apk_full_version_free_download_with_obb_mod.pdf
- https://cdn.shopify.com/s/files/1/0486/2423/8757/files/fluid_mechanics_2nd_edition_hibbeler_solutions_manual.pdf
- https://cdn.shopify.com/s/files/1/0494/0477/2508/files/commonlit_answer_key_the_veldt.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- site-1039847.mozfiles.com
- site-1040213.mozfiles.com
- site-1039833.mozfiles.com
- site-1042199.mozfiles.com
- site-1039800.mozfiles.com
- site-1036786.mozfiles.com
- site-1039391.mozfiles.com
- site-1036835.mozfiles.com
- site-1037114.mozfiles.com
- site-1037215.mozfiles.com
- site-1038884.mozfiles.com
- cdn.shopify.com
- gmail.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report