SUSPICIOUS — 3d6fa28d.pdf
SUSPICIOUS — 3d6fa28d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 50 detection engines flagged it.
Identification
- SHA-256:
969e21dea3cd2198b99177c4f19a118f9a036e52b0622bcf668e474b28b156a0 - SHA-1:
86537c00be248573bf5edba941dc796220a6ee14 - MD5:
ee1c8dcf998850f6c6429bd21889f2fb - ssdeep:
768:6RgGzpDVpPyKTxFkM0k0RiZC8QjY9xQOszlOcon9NOncEDTLH6Itct0NfX4OOLHs:5GFBpjQjOwnrDvPcsfXr+s - TLSH:
T1E12F5BF324A7DD8CBA879B03ACAB25696588C3486136D760498C273CD0BC27DBF144A1 - Submitted as: 3d6fa28d.pdf
- File type: pdf · Size: 33879 bytes
- Verdict: suspicious (35/100)
Detections (1 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=marriage%20invitation%20card%20in%20english%20pdf, https://cdn.shopify.com/s/files/1/0434/7969/5517/files/6030483962.pdf, https://cdn.shopify.com/s/files/1/0433/9499/0247/files/mevafilimizokedewixuki.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=marriage%20invitation%20card%20in%20english%20pdf
- https://cdn.shopify.com/s/files/1/0434/7969/5517/files/6030483962.pdf
- https://cdn.shopify.com/s/files/1/0433/9499/0247/files/mevafilimizokedewixuki.pdf
- https://cdn.shopify.com/s/files/1/0492/8189/2508/files/22847513536.pdf
- https://cdn.shopify.com/s/files/1/0438/2212/1122/files/text_messages_online_android.pdf
- https://cdn.shopify.com/s/files/1/0483/2601/7177/files/peavey_vypyr_30_manual_espaol.pdf
- https://cdn.shopify.com/s/files/1/0268/7162/7949/files/1291174079.pdf
- https://cdn.shopify.com/s/files/1/0502/8773/9035/files/ridutejazexinufumideb.pdf
- https://cdn.shopify.com/s/files/1/0500/4489/5392/files/5013744262.pdf
- https://s3.amazonaws.com/wonoti/jupixosipabelesifuremakaw.pdf
- https://s3.amazonaws.com/fasanag/losudim.pdf
- https://s3.amazonaws.com/zirojopemup/50299651128.pdf
- https://s3.amazonaws.com/zuxadol/58303701996.pdf
- https://s3.amazonaws.com/tesodagiwor/picsart_tutorial.pdf
- https://s3.amazonaws.com/henghuili-files/85122700852.pdf
- https://s3.amazonaws.com/leguvefu/dosiguboji.pdf
- https://s3.amazonaws.com/kavitokolezub/natotenuge.pdf
- https://cdn-cms.f-static.net/uploads/4374533/normal_5f9232edd1a07.pdf
- https://cdn-cms.f-static.net/uploads/4370055/normal_5f8c0b15580c5.pdf
- https://cdn-cms.f-static.net/uploads/4379603/normal_5f91f880dea90.pdf
- https://cdn-cms.f-static.net/uploads/4365620/normal_5f91653127adf.pdf
- https://cdn-cms.f-static.net/uploads/4365607/normal_5f879f6a14f34.pdf
- https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/beparinunij.pdf
- https://pufibifisap.weebly.com/uploads/1/3/4/4/134450659/8690762.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- s3.amazonaws.com
- cdn-cms.f-static.net
- jawasolasazilem.weebly.com
- pufibifisap.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report