SUSPICIOUS — c4888d02c.pdf
SUSPICIOUS — c4888d02c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
926102ab4ac18beb31e9c05071f63c144f18131c8569ed8676ad631c119245c4 - SHA-1:
f89752c6dd20217c80af8b7866bdc9f98b0ea8a8 - MD5:
339045ebd486655a0c68fd13aac2ddc0 - ssdeep:
768:IgGzpDtpgd+vTwp02lnWQkZKoTYjPUmQplxQQqPLKn7BAEcP17R7kXKQy1Sybghz:FGFBpplxQRG7BAEcP17ZkXOSybghsYuo - TLSH:
T110318DF36087EC4C7A4BD723ADAB1659258CCB88A136D790459C772DD4BC6BDAF10820 - Submitted as: c4888d02c.pdf
- File type: pdf · Size: 40368 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=essentials%20of%20physical%20anthropology, https://cdn-cms.f-static.net/uploads/4366340/normal_5f870f1635d67.pdf, https://cdn-cms.f-static.net/uploads/4365656/normal_5f874bf1bfb34.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=essentials%20of%20physical%20anthropology
- https://cdn-cms.f-static.net/uploads/4366340/normal_5f870f1635d67.pdf
- https://cdn-cms.f-static.net/uploads/4365656/normal_5f874bf1bfb34.pdf
- https://cdn-cms.f-static.net/uploads/4366978/normal_5f874d29b771d.pdf
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f87417e3a9fe.pdf
- https://cdn-cms.f-static.net/uploads/4365536/normal_5f87143b03372.pdf
- https://cdn-cms.f-static.net/uploads/4365600/normal_5f873f425d303.pdf
- https://cdn-cms.f-static.net/uploads/4366308/normal_5f874aa090a69.pdf
- https://cdn-cms.f-static.net/uploads/4366031/normal_5f8701221501f.pdf
- https://cdn-cms.f-static.net/uploads/4365657/normal_5f86f4da68ccf.pdf
- https://cdn.shopify.com/s/files/1/0438/5911/6182/files/blood_crucible_witchery.pdf
- https://cdn.shopify.com/s/files/1/0437/7152/7319/files/gorujazowojij.pdf
- https://cdn.shopify.com/s/files/1/0496/0606/6325/files/return_on_assets_calculator.pdf
- https://cdn.shopify.com/s/files/1/0498/0057/7187/files/larumetebujaxufaxis.pdf
- https://cdn.shopify.com/s/files/1/0501/0345/1813/files/7317198091.pdf
- https://cdn.shopify.com/s/files/1/0488/2002/7557/files/amazon_prime_video_android_tv_apk_download_apkmirror.pdf
- https://cdn.shopify.com/s/files/1/0485/0194/8577/files/zipenitudibit.pdf
- https://cdn.shopify.com/s/files/1/0431/7026/7300/files/swat_maps_crop_pro.pdf
- https://cdn.shopify.com/s/files/1/0478/0320/3751/files/craigslist_colorado_springs_accounting_jobs.pdf
- https://site-1043939.mozfiles.com/files/1043939/11026865644.pdf
- https://site-1039768.mozfiles.com/files/1039768/buzonedud.pdf
- https://site-1044192.mozfiles.com/files/1044192/torufinufaz.pdf
- https://site-1042733.mozfiles.com/files/1042733/67734319867.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- site-1043939.mozfiles.com
- site-1039768.mozfiles.com
- site-1044192.mozfiles.com
- site-1042733.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report