SUSPICIOUS — 045b66.pdf
SUSPICIOUS — 045b66.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7f31c6a12a4a492aee7473c6bc32b7f9eabfb38af6cb1a9143962bd22283c0df - SHA-1:
8e2e4d26b0589958aa2b58754d60e76dda8931a4 - MD5:
c4a955994cb9cc2f3473ee1faff77ca4 - ssdeep:
768:VgGzpDtnedvucriCWEqi85gPuWuyExDDbH1EZUOoEN0SEw7/qzc53:GGFtedlZrE3EZUOP9Ek/Ac53 - TLSH:
T186327DF35097DC9C79CADB036CAB256A218AC74C623AD75019CCBB2CD5BC66D7E00460 - Submitted as: 045b66.pdf
- File type: pdf · Size: 46938 bytes
- Verdict: suspicious (58/100)
Detections (2 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://desaviguwogo.weebly.com/uploads/1/3/1/8/131871994/6334261.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=great%20building%20guide%20forge%20of%20empire, https://desaviguwogo.weebly.com/uploads/1/3/1/8/131871994/6334261.pdf, https://junoxavod.weebly.com/uploads/1/3/1/3/131384771/lagumisebemaja.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=great%20building%20guide%20forge%20of%20empire
- https://desaviguwogo.weebly.com/uploads/1/3/1/8/131871994/6334261.pdf
- https://junoxavod.weebly.com/uploads/1/3/1/3/131384771/lagumisebemaja.pdf
- https://nurekagenarufab.weebly.com/uploads/1/3/1/6/131636906/vagetalog-juxifemaragepux-bobedel-kifal.pdf
- https://pavowojavujide.weebly.com/uploads/1/3/1/3/131398322/6878281.pdf
- https://jamuseramomuf.weebly.com/uploads/1/3/1/8/131871426/198c460007.pdf
- https://uploads.strikinglycdn.com/files/5dbc2a01-6d24-4f75-87ca-ff8d1fe2b53f/33101609586.pdf
- https://uploads.strikinglycdn.com/files/d1286a6b-37b6-4ce7-84a9-454aa29165c0/10174165943.pdf
- https://uploads.strikinglycdn.com/files/db11f8f5-b664-4a1d-86d2-88280bc9f58a/fifarafuzugelosu.pdf
- https://cdn.shopify.com/s/files/1/0432/5474/3200/files/budevijositakib.pdf
- https://cdn.shopify.com/s/files/1/0434/7360/0678/files/88759983003.pdf
- https://cdn.shopify.com/s/files/1/0433/2532/5467/files/46544223648.pdf
- https://cdn.shopify.com/s/files/1/0482/3095/7208/files/cute_female_pig_names.pdf
- https://uploads.strikinglycdn.com/files/9117c258-83d3-48a0-b9c7-e06b119489b8/1983146284.pdf
- https://uploads.strikinglycdn.com/files/fbe8e5ef-af38-4254-9cf8-fab638161f7a/xovuvixuzunemugi.pdf
- https://uploads.strikinglycdn.com/files/2aaf29b5-b086-430c-95d6-9ad67e4eb693/josogad.pdf
- https://uploads.strikinglycdn.com/files/7b294a48-a2b4-409a-a82f-a59f6fa0f766/subuwewixuv.pdf
- https://wekubuzebebam.weebly.com/uploads/1/3/0/7/130739705/3170296.pdf
- https://sonilotosoj.weebly.com/uploads/1/3/1/3/131379329/1163317.pdf
- https://mogezisatizate.weebly.com/uploads/1/3/0/7/130775403/sebigek-jexaganaze-pudulimoluto-fanewowetono.pdf
- https://pojutawetuje.weebly.com/uploads/1/3/1/3/131382470/4489358.pdf
- https://tekegalesi.weebly.com/uploads/1/3/0/7/130740489/jejesulovegetugegut.pdf
- https://cdn.shopify.com/s/files/1/0497/8494/6850/files/jamewag.pdf
- https://cdn.shopify.com/s/files/1/0428/3678/7356/files/zadosujidemedifira.pdf
- https://cdn.shopify.com/s/files/1/0484/4512/8858/files/90902345363.pdf
Embedded domains
- cctraff.ru
- desaviguwogo.weebly.com
- junoxavod.weebly.com
- nurekagenarufab.weebly.com
- pavowojavujide.weebly.com
- jamuseramomuf.weebly.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- wekubuzebebam.weebly.com
- sonilotosoj.weebly.com
- mogezisatizate.weebly.com
- pojutawetuje.weebly.com
- tekegalesi.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report