SUSPICIOUS — bafa5.pdf
SUSPICIOUS — bafa5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
7dc045eabfa943fa0df14b4258042edbcf11db36463950a37e8816a370815e85 - SHA-1:
6b6adc28630f39af31802ca5407f1b856f014121 - MD5:
5b0416bc6e6212ce16b3094d931613ba - ssdeep:
1536:AGFXpjiULEZKla3+mQ+UJDvvD6bd0F/e23wf0vSGEM:NFXpnlQuDvrgI/73fvSy - TLSH:
T148349EF31067FD8C7B8BAB03ADAB015D608AD68DA022D790558C3A1CD57CABD7F10A51 - Submitted as: bafa5.pdf
- File type: pdf · Size: 54505 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=skyrim%20how%20to%20get%20lakeview%20manor, https://cdn.shopify.com/s/files/1/0437/2919/1066/files/75611832044.pdf, https://cdn.shopify.com/s/files/1/0483/5793/3219/files/ccsk_official_study_guide.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=skyrim%20how%20to%20get%20lakeview%20manor
- https://cdn.shopify.com/s/files/1/0437/2919/1066/files/75611832044.pdf
- https://cdn.shopify.com/s/files/1/0483/5793/3219/files/ccsk_official_study_guide.pdf
- https://cdn.shopify.com/s/files/1/0433/8935/4142/files/wow_guardian_druid_leveling.pdf
- https://cdn.shopify.com/s/files/1/0485/0473/3857/files/nakibexasujeragulibafe.pdf
- https://cdn.shopify.com/s/files/1/0483/2480/4761/files/final_answer_bull.pdf
- https://site-1039925.mozfiles.com/files/1039925/51760324587.pdf
- https://site-1039633.mozfiles.com/files/1039633/78623929829.pdf
- https://site-1041944.mozfiles.com/files/1041944/nuterigo.pdf
- https://site-1042941.mozfiles.com/files/1042941/80192033428.pdf
- https://cdn.shopify.com/s/files/1/0496/5856/0661/files/red_river_revel.pdf
- https://cdn.shopify.com/s/files/1/0497/1842/7809/files/23101698616.pdf
- https://cdn.shopify.com/s/files/1/0440/0775/1838/files/love_me_if_you_dare_movie.pdf
- https://cdn.shopify.com/s/files/1/0430/2068/1369/files/geet_fuel_processor.pdf
- https://cdn-cms.f-static.net/uploads/4368964/normal_5f8825dd90f5c.pdf
- https://cdn-cms.f-static.net/uploads/4366005/normal_5f86f416a9ff4.pdf
- https://cdn-cms.f-static.net/uploads/4368985/normal_5f88011daede1.pdf
- https://cdn-cms.f-static.net/uploads/4366993/normal_5f87579f6b102.pdf
- https://cdn-cms.f-static.net/uploads/4367911/normal_5f8904ef0951c.pdf
- https://cdn-cms.f-static.net/uploads/4366028/normal_5f872325386ec.pdf
- https://cdn-cms.f-static.net/uploads/4368978/normal_5f885ad4a155a.pdf
- https://cdn-cms.f-static.net/uploads/4365598/normal_5f870baa0aac0.pdf
- https://cdn.shopify.com/s/files/1/0483/5459/0880/files/android_circular_progress_bar_with_percentage_library.pdf
- https://cdn.shopify.com/s/files/1/0431/9943/0815/files/mickey_mouse_coffe_mug.pdf
- https://cdn.shopify.com/s/files/1/0461/7859/9066/files/lanazujibuv.pdf
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- site-1039925.mozfiles.com
- site-1039633.mozfiles.com
- site-1041944.mozfiles.com
- site-1042941.mozfiles.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report