SUSPICIOUS — 2300349.pdf
SUSPICIOUS — 2300349.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
8b2bfccbbfe34e199c9e4f06609daadcf90132ce21d51d583c295731475baa96 - SHA-1:
5e4cd5ea3418ce2061e811a92081928e842028fd - MD5:
b91dc9f9d3ac889a61fa29cded48ec32 - ssdeep:
1536:lPGFapxrydV45cP5/TkPDrFrgrXnycWypL:l+Fapt1QkrrBgrXycWQL - TLSH:
T108339EF36097ED4CBB8B6B13ADA7149A6049D388A237D760058CA73CC4BC5AD7F11825 - Submitted as: 2300349.pdf
- File type: pdf · Size: 51681 bytes
- Verdict: suspicious (58/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://dojudiwoju.weebly.com/uploads/1/3/1/4/131406456/vozevogos.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=the%20simple%20strategy%20pdf, https://dojudiwoju.weebly.com/uploads/1/3/1/4/131406456/vozevogos.pdf, https://zimiduninu.weebly.com/uploads/1/3/1/6/131637103/7bf0538fede6e3d.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=the%20simple%20strategy%20pdf
- https://dojudiwoju.weebly.com/uploads/1/3/1/4/131406456/vozevogos.pdf
- https://zimiduninu.weebly.com/uploads/1/3/1/6/131637103/7bf0538fede6e3d.pdf
- https://vawotitalu.weebly.com/uploads/1/3/2/7/132710714/2332972.pdf
- https://legadiduzavof.weebly.com/uploads/1/3/2/6/132681829/potakafirawufotop.pdf
- https://uploads.strikinglycdn.com/files/ac9d1d84-1aeb-48da-a59d-6123497eb078/zufosanibilawebivav.pdf
- https://uploads.strikinglycdn.com/files/ed8b6866-23dc-4db4-a357-8cae9077aff6/88069913242.pdf
- https://uploads.strikinglycdn.com/files/2be6dab2-8853-4159-ab56-b85f03789492/84550154876.pdf
- https://uploads.strikinglycdn.com/files/17390b45-22c5-4b18-88f2-91e34df3baac/wonukobukopuvejilewanuzum.pdf
- https://uploads.strikinglycdn.com/files/1e5690ca-717d-4299-ba58-23fa1b4cbb51/fozulavisuwovilavifof.pdf
- https://cdn-cms.f-static.net/uploads/4368497/normal_5f88ba5a9c849.pdf
- https://cdn-cms.f-static.net/uploads/4366661/normal_5f8740319b130.pdf
- https://cdn-cms.f-static.net/uploads/4366044/normal_5f87cd69258c2.pdf
- https://cdn-cms.f-static.net/uploads/4366385/normal_5f88be123e1cb.pdf
- https://cdn-cms.f-static.net/uploads/4372080/normal_5f88bdaa0d97b.pdf
- https://site-1038508.mozfiles.com/files/1038508/11822209553.pdf
- https://site-1038985.mozfiles.com/files/1038985/57028653458.pdf
- https://site-1040041.mozfiles.com/files/1040041/5396660413.pdf
- https://site-1041770.mozfiles.com/files/1041770/98890739078.pdf
- https://site-1042671.mozfiles.com/files/1042671/suzutusutovusiri.pdf
- https://zesopupejilit.weebly.com/uploads/1/3/0/7/130738861/215b56d32c.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/jibigamefomoni.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/sidobojugonuxexoz.pdf
- https://ridolagu.weebly.com/uploads/1/3/0/7/130775195/8963435.pdf
- https://cdn-cms.f-static.net/uploads/4367648/normal_5f8767926cfb9.pdf
Embedded domains
- gettraff.ru
- dojudiwoju.weebly.com
- zimiduninu.weebly.com
- vawotitalu.weebly.com
- legadiduzavof.weebly.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- site-1038508.mozfiles.com
- site-1038985.mozfiles.com
- site-1040041.mozfiles.com
- site-1041770.mozfiles.com
- site-1042671.mozfiles.com
- zesopupejilit.weebly.com
- fijojonibiw.weebly.com
- dutitujazekap.weebly.com
- ridolagu.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report