SUSPICIOUS — f3b87822.pdf
SUSPICIOUS — f3b87822.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
9508b0bb6e3b85109f5190cdc0868c01b609c3d5698f8e6ca869b96fd87ed920 - SHA-1:
805c26c38060e0cb10190eae2f7cb0a0260a5afa - MD5:
a8a68b08f91abc90d1f323715fd8e296 - ssdeep:
1536:IGF8eG4SH8WbSr2RapGDcxNfdbYrfqLiuxujX8tyZXsUof:lF8ePonbSr2RaGcxN5Yrf2icy5U - TLSH:
T17636AEF350D7DD4C7A879B437DEA24A8A15ADA88A232DB60448D772CC4BC77D7E40A40 - Submitted as: f3b87822.pdf
- File type: pdf · Size: 63575 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=nv4500%20shop%20manual, https://uploads.strikinglycdn.com/files/41183465-ba78-4ff1-a1c3-84540a179dfa/72376433783.pdf, https://uploads.strikinglycdn.com/files/1812bae1-461b-493d-91cc-99b0ea40eee7/sutibezumokedutigifutun.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=nv4500%20shop%20manual
- https://uploads.strikinglycdn.com/files/41183465-ba78-4ff1-a1c3-84540a179dfa/72376433783.pdf
- https://uploads.strikinglycdn.com/files/1812bae1-461b-493d-91cc-99b0ea40eee7/sutibezumokedutigifutun.pdf
- https://uploads.strikinglycdn.com/files/0d136efb-2286-42e5-ace2-b2b634e92a2d/wujibidibemutofamelosogi.pdf
- https://uploads.strikinglycdn.com/files/754cc4de-1e30-4f48-92b8-7c78f56f0017/99629332291.pdf
- https://uploads.strikinglycdn.com/files/60f2d45e-86f9-42a6-9d7b-1cd98b13dadd/9801408390.pdf
- https://uploads.strikinglycdn.com/files/eb63b707-f7c7-4095-9d11-ff35a8f7103d/53833241308.pdf
- https://uploads.strikinglycdn.com/files/26e3f967-e1a7-4d28-9897-0099634d2ff2/77344569880.pdf
- https://uploads.strikinglycdn.com/files/97362c55-9ee2-42fe-b64b-767a8f5383c2/gomafapidogafopajalo.pdf
- https://uploads.strikinglycdn.com/files/18224eb0-6903-40f4-bd6c-a6561ca26305/34991132713.pdf
- https://uploads.strikinglycdn.com/files/c80f2b57-754e-4c96-b00f-52d07f89c850/53879740631.pdf
- https://site-1040507.mozfiles.com/files/1040507/57857248824.pdf
- https://site-1043844.mozfiles.com/files/1043844/18783362054.pdf
- https://site-1036939.mozfiles.com/files/1036939/48131582622.pdf
- https://site-1042279.mozfiles.com/files/1042279/94043817373.pdf
- https://cdn-cms.f-static.net/uploads/4366304/normal_5f87b9c88161b.pdf
- https://cdn-cms.f-static.net/uploads/4366645/normal_5f875b64287ec.pdf
- https://dirigesibujov.weebly.com/uploads/1/3/0/9/130969991/zofej_vuwolu.pdf
- https://xuvakaxatal.weebly.com/uploads/1/3/1/0/131070170/2096404.pdf
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/ce02014a20d.pdf
- https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/8742796.pdf
- https://cdn.shopify.com/s/files/1/0434/6550/6966/files/mazex.pdf
- https://cdn.shopify.com/s/files/1/0501/2986/2816/files/ffxiv_unspoiled_nodes_timer.pdf
- https://cdn.shopify.com/s/files/1/0497/4510/0954/files/vopizado.pdf
- https://cdn.shopify.com/s/files/1/0477/4694/1084/files/poe_marauder_beginner_guide.pdf
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- site-1040507.mozfiles.com
- site-1043844.mozfiles.com
- site-1036939.mozfiles.com
- site-1042279.mozfiles.com
- cdn-cms.f-static.net
- dirigesibujov.weebly.com
- xuvakaxatal.weebly.com
- bedizegoresupa.weebly.com
- mogilifus.weebly.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report