SUSPICIOUS — 9134513.pdf
SUSPICIOUS — 9134513.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
913578b78d4ee4f3774c6c69cbb0cfc49e87e360b5063c026efccc7d452b3d41 - SHA-1:
15733274732e1e797002bc864d60cf08208c0176 - MD5:
cfdb24b5529c537b2d4d48e3a49b5e89 - ssdeep:
768:1xgGzpDlpq++lA4MPR9A6kB39AdnBGcx0RS9rh2FJAIBKhCCEt9:sGFhpZutSP2FVBEEt9 - TLSH:
T161315CF350A3DE0CBB8B9B539EAB119A648DD389A036D790448C672CD4FC5BD7E60460 - Submitted as: 9134513.pdf
- File type: pdf · Size: 40864 bytes
- Verdict: suspicious (35/100)
Detections (1 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=descargar%20mlp%20fighting%20is%20magic%20premium%20edition, https://site-1036691.mozfiles.com/files/1036691/nogasaxajejexumutorikuje.pdf, https://site-1037909.mozfiles.com/files/1037909/23109913090.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=descargar%20mlp%20fighting%20is%20magic%20premium%20edition
- https://site-1036691.mozfiles.com/files/1036691/nogasaxajejexumutorikuje.pdf
- https://site-1037909.mozfiles.com/files/1037909/23109913090.pdf
- https://site-1042834.mozfiles.com/files/1042834/sovov.pdf
- https://site-1040613.mozfiles.com/files/1040613/besagikamewopikodiwe.pdf
- https://site-1040879.mozfiles.com/files/1040879/81876204614.pdf
- https://uploads.strikinglycdn.com/files/0026e9ec-7c2c-4ddc-b435-57e5b3faf709/bewuzutesiwibe.pdf
- https://uploads.strikinglycdn.com/files/2d84f890-1511-4fa2-9b1b-695d5a1693a7/86265285526.pdf
- https://uploads.strikinglycdn.com/files/7f70867d-bda8-49ec-8b2d-7fa3c7291969/sokoko.pdf
- https://uploads.strikinglycdn.com/files/0891b594-fd9e-451b-9b56-252c8f1ad33d/66984127700.pdf
- https://uploads.strikinglycdn.com/files/f051067f-d2df-43ff-b3ed-8fdd6483a0ea/bironutaviporitijo.pdf
- https://site-1043653.mozfiles.com/files/1043653/xizujov.pdf
- https://site-1036957.mozfiles.com/files/1036957/luwonumafowe.pdf
- https://site-1039785.mozfiles.com/files/1039785/begij.pdf
- https://site-1038631.mozfiles.com/files/1038631/wivikawojinolupemodax.pdf
- https://site-1039465.mozfiles.com/files/1039465/63843147733.pdf
- https://cdn-cms.f-static.net/uploads/4366660/normal_5f87b1c15bad1.pdf
- https://cdn-cms.f-static.net/uploads/4365653/normal_5f8704db3b79d.pdf
- https://cdn-cms.f-static.net/uploads/4366655/normal_5f8743c178af4.pdf
- https://cdn-cms.f-static.net/uploads/4366661/normal_5f87257304157.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f86f96cd4331.pdf
- https://cdn-cms.f-static.net/uploads/4366382/normal_5f872bb80c7b7.pdf
- https://cdn-cms.f-static.net/uploads/4367665/normal_5f87d0ac4b75e.pdf
- https://cdn-cms.f-static.net/uploads/4365639/normal_5f87bf9249594.pdf
- https://cdn-cms.f-static.net/uploads/4367297/normal_5f879add38ab4.pdf
Embedded domains
- cctraff.ru
- site-1036691.mozfiles.com
- site-1037909.mozfiles.com
- site-1042834.mozfiles.com
- site-1040613.mozfiles.com
- site-1040879.mozfiles.com
- uploads.strikinglycdn.com
- site-1043653.mozfiles.com
- site-1036957.mozfiles.com
- site-1039785.mozfiles.com
- site-1038631.mozfiles.com
- site-1039465.mozfiles.com
- cdn-cms.f-static.net
- youtube.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report