SUSPICIOUS — isla_nublar_discord.pdf
SUSPICIOUS — isla_nublar_discord.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7b916bf85d43ef1a5b0478611217cd31a9db063a243f8f952c412047f4bfd8b5 - SHA-1:
f2f85f805389b67cbfe19ad3132ef806ba249e0b - MD5:
b92417af38de8d6a449be1ea160b7619 - ssdeep:
768:VgGzpDnp6AD2Fotx3FvZsrMTsVGLPQxbHngqWjceqFFGNU0WGbqNit7ujfKSujPn:GGFLpTRmmNUMbzujGPG+ - TLSH:
T15F317CF75097DC8D7A8B9B43ACEB156A518AC34D6237E390448C272CE4BC6BE7E10851 - Submitted as: isla_nublar_discord.pdf
- File type: pdf · Size: 39902 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/cd16d8fa-5864-4273-85f2-cba7657aba9a/matisusovarakavumiwoma.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/strik?keyword=isla+nublar+discord, https://uploads.strikinglycdn.com/files/cd16d8fa-5864-4273-85f2-cba7657aba9a/matisusovarakavumiwoma.pdf, https://uploads.strikinglycdn.com/files/321c5a9a-d07d-497e-a049-bef583214e57/83994541504.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/strik?keyword=isla+nublar+discord
- https://uploads.strikinglycdn.com/files/cd16d8fa-5864-4273-85f2-cba7657aba9a/matisusovarakavumiwoma.pdf
- https://uploads.strikinglycdn.com/files/321c5a9a-d07d-497e-a049-bef583214e57/83994541504.pdf
- https://uploads.strikinglycdn.com/files/ecebf600-e498-4e7e-a245-afe9f7d8887d/mamerekaguba.pdf
- https://uploads.strikinglycdn.com/files/83c06ab8-3ae5-40f0-a5ef-df583976ffea/nufarobinelaxuwibivobo.pdf
- https://uploads.strikinglycdn.com/files/9d771dc3-04e7-47a0-931d-8260d3aa49f7/vekasilafilusixobavofewu.pdf
- https://cdn-cms.f-static.net/uploads/4369164/normal_5f89440bf1572.pdf
- https://cdn-cms.f-static.net/uploads/4380226/normal_5f8b58c82c3f5.pdf
- https://cdn-cms.f-static.net/uploads/4366347/normal_5f87d5e174219.pdf
- https://cdn-cms.f-static.net/uploads/4375095/normal_5f8be0cbe8381.pdf
- https://cdn-cms.f-static.net/uploads/4367013/normal_5f873f4285f43.pdf
- https://cdn.shopify.com/s/files/1/0482/5622/1345/files/juegos_atletismo_iniciacion.pdf
- https://cdn.shopify.com/s/files/1/0492/4692/9052/files/star_wars_dark_disciple_download.pdf
- https://cdn.shopify.com/s/files/1/0430/7111/1330/files/80732093473.pdf
- https://cdn.shopify.com/s/files/1/0430/7868/0727/files/wegimibagajogepuk.pdf
- https://tejigenunonim.weebly.com/uploads/1/3/0/8/130813632/9391773.pdf
- https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/9945460.pdf
- https://cdn.shopify.com/s/files/1/0482/9924/5723/files/global_precipitation_measurement_mission_webquest_answer_key.pdf
- https://cdn.shopify.com/s/files/1/0484/4031/1976/files/fox_valley_tech_appleton_classes.pdf
- https://cdn.shopify.com/s/files/1/0440/2728/1558/files/jafimileku.pdf
- https://cdn.shopify.com/s/files/1/0431/5650/4744/files/microsoft_word_2013_kickass.pdf
- https://cdn.shopify.com/s/files/1/0503/2732/2774/files/nepanebanukujawepuzel.pdf
- https://cdn.shopify.com/s/files/1/0484/7121/2193/files/laraxuxufib.pdf
- https://cdn.shopify.com/s/files/1/0481/4494/1223/files/wamuwebamogozevebep.pdf
- https://cdn.shopify.com/s/files/1/0499/1329/9102/files/mitosis_coloring_worksheet_answer_key.pdf
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- cdn.shopify.com
- tejigenunonim.weebly.com
- wepugimi.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report