SUSPICIOUS — 6765507.pdf
SUSPICIOUS — 6765507.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
8b594addec1bd65f0ab220c0e655e8b6ef42948b22492333ca562b5323e5dc69 - SHA-1:
3c645c347f9a68dd823766556137f1f82faf4562 - MD5:
a4afaffd971b00b0aa6afbdf82c2efcb - ssdeep:
768:4gGzpDuzeVfDnAMZ9+q1zXoFnGBNn1aq5Vpp:VGFqGAMZkYzXoFnGBNAq5Vpp - TLSH:
T1AF329DF3D0E7ED9C7A8AAF076DBB104DA419D3486122A75019CC366C947C2FEBE50960 - Submitted as: 6765507.pdf
- File type: pdf · Size: 43531 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=polygons%20and%20angles%20worksheet, https://uploads.strikinglycdn.com/files/c251128c-38d3-49fc-aa66-4ca1bb3cfe23/31789770969.pdf, https://uploads.strikinglycdn.com/files/243dfd68-ef77-438f-b7b4-178a60789407/80433242437.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=polygons%20and%20angles%20worksheet
- https://mipezutaxujo.files.wordpress.com/2020/11/49636059275.pdf
- https://uploads.strikinglycdn.com/files/c251128c-38d3-49fc-aa66-4ca1bb3cfe23/31789770969.pdf
- https://uploads.strikinglycdn.com/files/243dfd68-ef77-438f-b7b4-178a60789407/80433242437.pdf
- https://sazajade.files.wordpress.com/2020/11/muwepowevavux.pdf
- https://uploads.strikinglycdn.com/files/931e330c-0df1-45a2-9a31-fb678597e369/tifunefereluvudo.pdf
- https://uploads.strikinglycdn.com/files/30f6feb3-a5a2-429f-9349-1a6c6b4f608d/41449781482.pdf
- https://fanunopufimu.files.wordpress.com/2020/11/marisivasajuxe.pdf
- https://mudupetem.files.wordpress.com/2020/11/60700338149.pdf
- https://uploads.strikinglycdn.com/files/0b9e1eef-a1d2-47c1-9f23-958552c054d4/fokip.pdf
- https://sexonilapaxo.files.wordpress.com/2020/11/kotajuwivaxox.pdf
- https://uploads.strikinglycdn.com/files/4fad18c1-4224-45f1-9dfa-a84a6c463838/89970407426.pdf
- https://uploads.strikinglycdn.com/files/19210de2-d422-455e-9636-b066b88bbf87/govirolesesozapeve.pdf
- https://uploads.strikinglycdn.com/files/6d395e44-4890-4922-8c8d-815119f61838/67022315417.pdf
- https://likuzow.files.wordpress.com/2020/11/40264502684.pdf
- https://pejopazuzaguwoz.weebly.com/uploads/1/3/2/8/132815183/netisukozuzuvip.pdf
- https://uploads.strikinglycdn.com/files/a7316928-9a76-48e5-b33f-a46b31c51454/tekenidujaworarabojavupux.pdf
- https://pupirod.files.wordpress.com/2020/11/sagob.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- mipezutaxujo.files.wordpress.com
- uploads.strikinglycdn.com
- sazajade.files.wordpress.com
- fanunopufimu.files.wordpress.com
- mudupetem.files.wordpress.com
- sexonilapaxo.files.wordpress.com
- likuzow.files.wordpress.com
- pejopazuzaguwoz.weebly.com
- pupirod.files.wordpress.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report