SUSPICIOUS — d6b8665e619d94.pdf
SUSPICIOUS — d6b8665e619d94.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
6fba55c2472eaa294e5ad64243b269e71e52f978c25c06af341ed352dd8a3105 - SHA-1:
21fe09da43dbe4a9a0078b162eaa31fb9989b2ba - MD5:
938437502e190a4167b9c0ceece8f306 - ssdeep:
1536:7GFJpiB+kPFfDaEAq1NI2ee1JDZ75vxlJf3r:aFJpEZDaqg2T7DZ7dxff7 - TLSH:
T1BA349EF35097ED8C7A8B9B13ADEB0669A48ED74D6022DBA05088672CD47CAEC7F10511 - Submitted as: d6b8665e619d94.pdf
- File type: pdf · Size: 52649 bytes
- Verdict: suspicious (44/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=toefl%20words%20list%20pdf, https://cdn-cms.f-static.net/uploads/4366312/normal_5f872bb5f295f.pdf, https://cdn-cms.f-static.net/uploads/4367631/normal_5f874ad3b1d0e.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=toefl%20words%20list%20pdf
- https://cdn-cms.f-static.net/uploads/4366312/normal_5f872bb5f295f.pdf
- https://cdn-cms.f-static.net/uploads/4367631/normal_5f874ad3b1d0e.pdf
- https://cdn-cms.f-static.net/uploads/4366369/normal_5f8717d3e736e.pdf
- https://cdn-cms.f-static.net/uploads/4369499/normal_5f87daba4bcb1.pdf
- https://cdn-cms.f-static.net/uploads/4368266/normal_5f878b630e4e1.pdf
- https://cdn.shopify.com/s/files/1/0483/6153/7689/files/38197542092.pdf
- https://cdn.shopify.com/s/files/1/0496/6223/0679/files/22179534667.pdf
- https://cdn.shopify.com/s/files/1/0432/2417/0664/files/let_it_die_wiki_jp.pdf
- https://cdn.shopify.com/s/files/1/0501/7442/7296/files/wamuzex.pdf
- https://cdn.shopify.com/s/files/1/0501/0518/8515/files/field_epidemiology_book.pdf
- https://sakuvida.weebly.com/uploads/1/3/0/7/130775714/8693383.pdf
- https://vozunutav.weebly.com/uploads/1/3/0/9/130969695/zuwerevufu_fakodo_wotinete_rajizelu.pdf
- https://naroxelilokatud.weebly.com/uploads/1/3/1/3/131384214/f1f3b269b998cb4.pdf
- https://walijogopabo.weebly.com/uploads/1/3/0/7/130776167/5300225.pdf
- https://site-1042629.mozfiles.com/files/1042629/58332578156.pdf
- https://site-1040396.mozfiles.com/files/1040396/geteworifozexatibafobigor.pdf
- https://site-1038679.mozfiles.com/files/1038679/daxufadepazevux.pdf
- https://site-1041387.mozfiles.com/files/1041387/furalo.pdf
- https://site-1040094.mozfiles.com/files/1040094/kologufutifaw.pdf
- https://cdn-cms.f-static.net/uploads/4365555/normal_5f87ba38a9314.pdf
- https://cdn-cms.f-static.net/uploads/4367632/normal_5f87c7493d939.pdf
- https://cdn-cms.f-static.net/uploads/4367947/normal_5f876f398f52b.pdf
- https://cdn-cms.f-static.net/uploads/4369150/normal_5f87c637cb9ca.pdf
- https://cdn-cms.f-static.net/uploads/4365541/normal_5f876f6695f09.pdf
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- sakuvida.weebly.com
- vozunutav.weebly.com
- naroxelilokatud.weebly.com
- walijogopabo.weebly.com
- site-1042629.mozfiles.com
- site-1040396.mozfiles.com
- site-1038679.mozfiles.com
- site-1041387.mozfiles.com
- site-1040094.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report