SUSPICIOUS — 66067736a30fa.pdf
SUSPICIOUS — 66067736a30fa.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
69550787804726c3dac8dc37f481620d3b736dd8fe4ae2024cd97cf6ce85530d - SHA-1:
79f4a26019ce7fec5f9d55dbdd75beb86285ac77 - MD5:
d119c8c151263e830de395090be0c6c0 - ssdeep:
768:GgGzpDnpfiyHsxtdahMMpwdQ1kpnb8UfyzrJ0DiB/W37Ro64Xq3zt0Wa2zx+inyr:TGFrph8A67RbKCOYgaOsegcIUwS - TLSH:
T1E034BFF364DBEC8D7A86AF53ACE61564149AD7896137EB50048C3B2CC0BC1BDBE11861 - Submitted as: 66067736a30fa.pdf
- File type: pdf · Size: 54898 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=hydrocyclone%20filter%20pdf, https://cdn-cms.f-static.net/uploads/4377931/normal_5f918be54b234.pdf, https://cdn-cms.f-static.net/uploads/4366660/normal_5f87cf1981486.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=hydrocyclone%20filter%20pdf
- https://cdn-cms.f-static.net/uploads/4377931/normal_5f918be54b234.pdf
- https://cdn-cms.f-static.net/uploads/4366660/normal_5f87cf1981486.pdf
- https://cdn-cms.f-static.net/uploads/4380384/normal_5f8d3a15ce836.pdf
- https://cdn-cms.f-static.net/uploads/4366302/normal_5f8735c23fd69.pdf
- https://cdn-cms.f-static.net/uploads/4368964/normal_5f87b4f3f4186.pdf
- https://cdn-cms.f-static.net/uploads/4367624/normal_5f876b0d575af.pdf
- https://cdn-cms.f-static.net/uploads/4366306/normal_5f8718f7e5c82.pdf
- https://cdn-cms.f-static.net/uploads/4369152/normal_5f8ea283cbfb5.pdf
- https://cdn-cms.f-static.net/uploads/4375716/normal_5f8d0b378c823.pdf
- https://cdn-cms.f-static.net/uploads/4381738/normal_5f8e0090e323f.pdf
- https://cdn.shopify.com/s/files/1/0435/3071/5288/files/types_of_schedule_in_dbms.pdf
- https://cdn.shopify.com/s/files/1/0496/9332/7517/files/jeronoxuker.pdf
- https://cdn.shopify.com/s/files/1/0484/9129/8978/files/car_alarm_wiring_diagrams.pdf
- https://cdn.shopify.com/s/files/1/0433/0458/3318/files/56969902466.pdf
- https://cdn.shopify.com/s/files/1/0500/0377/1547/files/27283011213.pdf
- https://uploads.strikinglycdn.com/files/71be9f26-f903-4508-bef9-61baef8bec65/nedivujaxuxakitobiferu.pdf
- https://uploads.strikinglycdn.com/files/3be7ddb2-ca96-4948-817f-e0fc1efdbfd4/lusisifanagajazare.pdf
- https://uploads.strikinglycdn.com/files/eaa46984-be5d-4d96-94ec-3660ff7f4328/61073309216.pdf
- https://uploads.strikinglycdn.com/files/7fa469f9-ba8e-44db-bab7-d6bd28b560e3/63348061574.pdf
- https://cdn-cms.f-static.net/uploads/4368244/normal_5f8f95313ecde.pdf
- https://cdn-cms.f-static.net/uploads/4368750/normal_5f893b8acb5e6.pdf
- https://cdn-cms.f-static.net/uploads/4368991/normal_5f8dd831012f7.pdf
- https://cdn-cms.f-static.net/uploads/4366622/normal_5f875e759ef73.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report