SUSPICIOUS — 3770832.pdf
SUSPICIOUS — 3770832.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
74a88b565a87b5aea265b9b6cd7dca648b995d9a6479fe903094b8544e3b568c - SHA-1:
640da4878cea6d8697ffe982dd23c5387f9163b4 - MD5:
28aeea5d6e280fa392c3642c601f3ea0 - ssdeep:
768:qgGzpDApQitGU4O/NvIioo/TZSmUlkp9Pl/:3GF8pQk9nbZSmmi9Pl/ - TLSH:
T1332F6CF710A7ED8C7D8B6B0369A605A9608AC78C703396A058DC772DC5BC2FD6F04661 - Submitted as: 3770832.pdf
- File type: pdf · Size: 33439 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=nec%20dth%2016d%202%20manual, https://uploads.strikinglycdn.com/files/6615463e-bf48-4a8b-9a1d-5455ada88e71/jonezaxuxowizemininim.pdf, https://uploads.strikinglycdn.com/files/0196ff86-ef32-4531-a014-3247faf73c7e/bibuwij.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=nec%20dth%2016d%202%20manual
- https://uploads.strikinglycdn.com/files/6615463e-bf48-4a8b-9a1d-5455ada88e71/jonezaxuxowizemininim.pdf
- https://uploads.strikinglycdn.com/files/0196ff86-ef32-4531-a014-3247faf73c7e/bibuwij.pdf
- https://uploads.strikinglycdn.com/files/d7f8495f-d626-4578-9f58-a8981b91f2d3/60658111833.pdf
- https://site-1044498.mozfiles.com/files/1044498/tuvud.pdf
- https://site-1038963.mozfiles.com/files/1038963/sogoregefu.pdf
- https://cdn-cms.f-static.net/uploads/4367668/normal_5f87b0e776299.pdf
- https://cdn-cms.f-static.net/uploads/4368750/normal_5f87b22a0e8a6.pdf
- https://cdn-cms.f-static.net/uploads/4366063/normal_5f86fe7f51593.pdf
- https://cdn-cms.f-static.net/uploads/4365660/normal_5f87247a2470a.pdf
- https://cdn-cms.f-static.net/uploads/4366057/normal_5f876c5bc559a.pdf
- https://fadusoga.weebly.com/uploads/1/3/0/7/130739873/fizaf-jadij.pdf
- https://zimiduninu.weebly.com/uploads/1/3/1/6/131637103/9402018.pdf
- https://uploads.strikinglycdn.com/files/712d0189-c0d2-4809-96c1-3b153253dd5e/27273999873.pdf
- https://uploads.strikinglycdn.com/files/d0375c21-ce06-4864-8c26-608e0ca2dd53/25634461377.pdf
- https://uploads.strikinglycdn.com/files/b6460e10-0a1f-441d-8d6a-4c7c98a2795c/tukezofibetigos.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- site-1044498.mozfiles.com
- site-1038963.mozfiles.com
- cdn-cms.f-static.net
- fadusoga.weebly.com
- zimiduninu.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report