SUSPICIOUS — 1615206.pdf
SUSPICIOUS — 1615206.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
7c4dc6db0a5a09a09010c8322da561e9144a2b3031182c67974e801782cdbfd9 - SHA-1:
858f967cca0e6985b39126bb01271593477512fb - MD5:
29e2a8b1e560c6eafd677475e96df363 - ssdeep:
768:sgGzpDipqK4iRBFkFKbnJIZ/fyvvBzr8MFlR6Xqulk0m3qF49IGPXs0a6AUv:pGFGpDp+yJlzrBzEw07OOGPXscAUv - TLSH:
T10B327EF340A3ED8CBA8F6B439DEB1159608AD78D51369B6045883B2CD57CAFE3E00951 - Submitted as: 1615206.pdf
- File type: pdf · Size: 46561 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=happy%20birthday%20piano%20sheet%20pdf%20easy, https://site-1044148.mozfiles.com/files/1044148/28893351052.pdf, https://site-1036832.mozfiles.com/files/1036832/gajasikojetu.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=happy%20birthday%20piano%20sheet%20pdf%20easy
- https://site-1044148.mozfiles.com/files/1044148/28893351052.pdf
- https://site-1036832.mozfiles.com/files/1036832/gajasikojetu.pdf
- https://site-1036698.mozfiles.com/files/1036698/57049890862.pdf
- https://site-1036833.mozfiles.com/files/1036833/pufuwiwuwep.pdf
- https://site-1042282.mozfiles.com/files/1042282/80615138623.pdf
- https://uploads.strikinglycdn.com/files/d57cc224-1def-4760-a65d-6d00ffeebdd1/mideronurej.pdf
- https://uploads.strikinglycdn.com/files/7cdc9157-4ea7-4148-bdf0-7c27bf600a4a/fadifamixuduj.pdf
- https://uploads.strikinglycdn.com/files/89679f73-a2f5-4105-b4fc-59ba8b37024c/72330696050.pdf
- https://uploads.strikinglycdn.com/files/3bbdceab-6c00-4b7e-92c8-93a3745308d2/92062635895.pdf
- https://uploads.strikinglycdn.com/files/6f0e7950-dada-44cd-9605-5dc43e550562/5505395112.pdf
- https://site-1036697.mozfiles.com/files/1036697/luzuvaw.pdf
- https://site-1039150.mozfiles.com/files/1039150/burelavebonolujuzozolofis.pdf
- https://site-1040298.mozfiles.com/files/1040298/72099708671.pdf
- https://uploads.strikinglycdn.com/files/510eb746-200f-4b3b-aa29-d90e86e10eba/mivaputikirawe.pdf
- https://uploads.strikinglycdn.com/files/547c2eb2-2e97-475a-971f-e6bebdfbeeea/gatode.pdf
- https://uploads.strikinglycdn.com/files/b66e1b3f-d5af-4213-a16d-8e865d206ac6/23952176330.pdf
- https://uploads.strikinglycdn.com/files/bf3deac7-2c6a-4310-821a-79933d9e2204/wemopesulim.pdf
- https://site-1036941.mozfiles.com/files/1036941/fizimupanukilupar.pdf
- https://site-1039959.mozfiles.com/files/1039959/1787601751.pdf
- https://site-1042199.mozfiles.com/files/1042199/63052854198.pdf
- https://site-1040321.mozfiles.com/files/1040321/wiwosuvonowowerogatelovif.pdf
- https://site-1039385.mozfiles.com/files/1039385/boniruzaneje.pdf
- https://cdn.shopify.com/s/files/1/0492/3867/1526/files/42209544556.pdf
- https://cdn.shopify.com/s/files/1/0484/3044/8792/files/cursive_capital_l_in_latex.pdf
Embedded domains
- gettraff.ru
- site-1044148.mozfiles.com
- site-1036832.mozfiles.com
- site-1036698.mozfiles.com
- site-1036833.mozfiles.com
- site-1042282.mozfiles.com
- uploads.strikinglycdn.com
- site-1036697.mozfiles.com
- site-1039150.mozfiles.com
- site-1040298.mozfiles.com
- site-1036941.mozfiles.com
- site-1039959.mozfiles.com
- site-1042199.mozfiles.com
- site-1040321.mozfiles.com
- site-1039385.mozfiles.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report