SUSPICIOUS — 9e88d5b07.pdf
SUSPICIOUS — 9e88d5b07.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6f767fbbd0424dba1b42fd3abdd1bfe43234196a23ec955e298d1c9c8af7eb1b - SHA-1:
be5cb533ff3ce63bf4734c07b253035045351744 - MD5:
66e3e358e736f38ffa20e14b7bf5adc2 - ssdeep:
768:wBgGzpDGpcqEQujTZN7I+Zgkap/SL3xoKw25e0kj1y7GkRei:wyGFapJCAkL382A0kgbRei - TLSH:
T179328EF310A7EE8C7A8B5F13EDB61598A04AD28C603697A0448C373DD4BC6ED6E01B51 - Submitted as: 9e88d5b07.pdf
- File type: pdf · Size: 44272 bytes
- Verdict: suspicious (58/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/0bc6d8d3-e11f-4dc7-9d03-7c655177e5f2/esen_yaynlar_matemat.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=notepad%20shortcut%20keys%20windows%207%20pdf, https://uploads.strikinglycdn.com/files/0bc6d8d3-e11f-4dc7-9d03-7c655177e5f2/esen_yaynlar_matemat.pdf, https://uploads.strikinglycdn.com/files/2d347823-1dbe-411e-b190-181e1b50da5f/673889917.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=notepad%20shortcut%20keys%20windows%207%20pdf
- https://uploads.strikinglycdn.com/files/0bc6d8d3-e11f-4dc7-9d03-7c655177e5f2/esen_yaynlar_matemat.pdf
- https://uploads.strikinglycdn.com/files/2d347823-1dbe-411e-b190-181e1b50da5f/673889917.pdf
- https://uploads.strikinglycdn.com/files/1a3c583d-3d86-4e65-aec8-2fd831130f00/vagepajudegakusiluged.pdf
- https://uploads.strikinglycdn.com/files/cc64502b-b35d-43d4-8a4f-04b211938d4f/nupotosisobevaxedena.pdf
- https://uploads.strikinglycdn.com/files/45c3e53a-f42b-45fe-ab83-97c09d9be665/8343878865.pdf
- https://uploads.strikinglycdn.com/files/26b76863-906e-4212-89c9-1e3327ce4696/tojilafudowi.pdf
- https://uploads.strikinglycdn.com/files/86c67cde-d81d-415c-995b-f1bce7ecd820/kuwoweseforajafeta.pdf
- https://uploads.strikinglycdn.com/files/fa4a0f92-282b-4a58-b5c9-1a46ae389dac/94743364685.pdf
- https://cdn-cms.f-static.net/uploads/4414672/normal_5f9655c6a5ffc.pdf
- https://cdn-cms.f-static.net/uploads/4367951/normal_5f8c11d65d499.pdf
- https://cdn-cms.f-static.net/uploads/4379742/normal_5f8cbe906b347.pdf
- https://cdn-cms.f-static.net/uploads/4366628/normal_5f87246fc3bb9.pdf
- https://cdn-cms.f-static.net/uploads/4382773/normal_5f906472e7b10.pdf
- https://uploads.strikinglycdn.com/files/0b26b963-1eaa-4496-9b9e-b6aad7d5b1f9/13605108575.pdf
- https://uploads.strikinglycdn.com/files/fbaeb025-1a89-47c9-9378-8e4ef8edcffb/loxafelupotumuzaras.pdf
- https://uploads.strikinglycdn.com/files/5becb8b6-6048-4bf1-8f8d-a43ac74f45db/14586639286.pdf
- https://jufukakoxojopop.weebly.com/uploads/1/3/4/3/134317893/tipomejenixinewiz.pdf
- https://mogidudurunupiz.weebly.com/uploads/1/3/2/6/132695636/ce43470f1.pdf
- https://tajurasexir.weebly.com/uploads/1/3/1/6/131606020/wonugoduludofasug.pdf
- https://cdn-cms.f-static.net/uploads/4372963/normal_5f889c4a39ff5.pdf
- https://cdn-cms.f-static.net/uploads/4369329/normal_5f89322ba9708.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- jufukakoxojopop.weebly.com
- mogidudurunupiz.weebly.com
- tajurasexir.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report