SUSPICIOUS — 14722504654.pdf
SUSPICIOUS — 14722504654.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
7daa9c33e49af114ef5042eb0d7f8c4fbb0a85efad1970728b013a44408271c5 - SHA-1:
11e8e5b5daface2e6c0fab925be2af67beed0d98 - MD5:
ce9f168d13602d579aea95ea5aafa5ed - ssdeep:
768:BgGzpD+pNBzVXEp3p+gNrOLV0KLUFyF2rMJ9VqrCBVo9CIdcqqHoyTiWJbh1CdXV:yGFSpNBzVUGTKCBVodcqSeeTCdX+liI6 - TLSH:
T18E326CF360D7DD4CB5878F136EAB29AD148ED38961229794418C676CC5BC7AD3E20820 - Submitted as: 14722504654.pdf
- File type: pdf · Size: 43562 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=sun+mere+humsafar+female+mp3+download, https://uploads.strikinglycdn.com/files/b51bc36b-cd58-4141-97e7-e2f12155d7d3/97171382498.pdf, https://uploads.strikinglycdn.com/files/ad22a5c0-1b22-4414-a398-f528cdb881fa/10275019416.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/strik?keyword=sun+mere+humsafar+female+mp3+download
- https://uploads.strikinglycdn.com/files/b51bc36b-cd58-4141-97e7-e2f12155d7d3/97171382498.pdf
- https://uploads.strikinglycdn.com/files/ad22a5c0-1b22-4414-a398-f528cdb881fa/10275019416.pdf
- https://uploads.strikinglycdn.com/files/9e950aa5-8c88-45fd-bef2-9c4b7af46102/xinuvikimadibexixuliv.pdf
- https://uploads.strikinglycdn.com/files/17ca98af-10ea-4e98-921f-bebc41c6f06b/janafurolutobipilolap.pdf
- https://uploads.strikinglycdn.com/files/b9ee70c3-ca0f-4352-a6e0-f404762c69af/11392849752.pdf
- https://cdn-cms.f-static.net/uploads/4366034/normal_5f8748a0725da.pdf
- https://cdn-cms.f-static.net/uploads/4366004/normal_5f8895eeb2f48.pdf
- https://cdn-cms.f-static.net/uploads/4365608/normal_5f896927bfdcb.pdf
- https://cdn-cms.f-static.net/uploads/4370561/normal_5f8b8297e5eca.pdf
- https://cdn-cms.f-static.net/uploads/4372101/normal_5f8bc2abb51fe.pdf
- https://cdn-cms.f-static.net/uploads/4368235/normal_5f8a0b5545c0c.pdf
- https://cdn-cms.f-static.net/uploads/4369777/normal_5f89fbf96bd9d.pdf
- https://cdn-cms.f-static.net/uploads/4376126/normal_5f8ac005aa66a.pdf
- https://cdn-cms.f-static.net/uploads/4365539/normal_5f8b8fb5672eb.pdf
- https://cdn-cms.f-static.net/uploads/4366317/normal_5f8a9381dbb59.pdf
- https://cdn-cms.f-static.net/uploads/4366399/normal_5f87ad4269e6e.pdf
- https://cdn-cms.f-static.net/uploads/4366327/normal_5f8787329768e.pdf
- https://cdn-cms.f-static.net/uploads/4369638/normal_5f881ba38a56f.pdf
- https://cdn-cms.f-static.net/uploads/4365662/normal_5f872c12359b8.pdf
- https://uploads.strikinglycdn.com/files/b2864fbc-cb41-47a7-9e28-7bc0012c28b7/97293337296.pdf
- https://uploads.strikinglycdn.com/files/8d1277ef-eb3f-472c-ad6f-3979c03975f8/66953805543.pdf
- https://cdn-cms.f-static.net/uploads/4365567/normal_5f8a931d810bb.pdf
- https://cdn-cms.f-static.net/uploads/4369643/normal_5f8961888d3f0.pdf
- https://cdn-cms.f-static.net/uploads/4366004/normal_5f86f9f350620.pdf
Embedded domains
- ggtraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- a10.gaanacdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report