SUSPICIOUS — 69933d8.pdf
SUSPICIOUS — 69933d8.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
9714a6c2cab4f54cef96f3154c4c1d4b8f074eb9e3a72438e0d46a9b913ab3ca - SHA-1:
e0c21ff36424b3460568468509c9413c310a789c - MD5:
56ee7ebff6d9ac17cac32503c93487ea - ssdeep:
768:vgGzpD9p8g8qFCQeRv5ioJrK4Lb65P/JH3xdq4FChFRICR3:YGF5p8goQG24Lb65PV3xdq4FWHICR3 - TLSH:
T1EB318CF70097EC4CB9CB9B47ADAA26555189D38CB236EBA0548C373CD0BC66D3E50860 - Submitted as: 69933d8.pdf
- File type: pdf · Size: 41815 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=don, https://uploads.strikinglycdn.com/files/ae955ada-e697-42a5-88cc-92204774ac6e/43300570131.pdf, https://uploads.strikinglycdn.com/files/08571d17-18e3-46c9-8034-7801939804d1/67955604117.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=don
- https://uploads.strikinglycdn.com/files/ae955ada-e697-42a5-88cc-92204774ac6e/43300570131.pdf
- https://uploads.strikinglycdn.com/files/08571d17-18e3-46c9-8034-7801939804d1/67955604117.pdf
- https://uploads.strikinglycdn.com/files/962582cc-46dc-484f-97bb-c81d2e39b30b/44358563805.pdf
- https://uploads.strikinglycdn.com/files/37d9f0ba-21fe-454e-a129-1666388e8276/lozadoluxirozexokorab.pdf
- https://uploads.strikinglycdn.com/files/1db128a0-1e72-41db-9586-f416b2cd72cf/tonabebapukajitob.pdf
- https://cdn.shopify.com/s/files/1/0481/4756/2645/files/dd_5e_players_handbook_download.pdf
- https://cdn.shopify.com/s/files/1/0496/5944/5401/files/oracle_12c_rac_installation_on_redhat_linux_6_step_by_step.pdf
- https://cdn.shopify.com/s/files/1/0431/4375/7985/files/togozemulapezivakavuna.pdf
- https://cdn.shopify.com/s/files/1/0475/4259/9846/files/environmental_education_for_sustainability_2020.pdf
- https://cdn.shopify.com/s/files/1/0496/2723/4455/files/4_hour_workweek_free.pdf
- https://uploads.strikinglycdn.com/files/6058526f-ce40-4c5b-a511-695d31c071ac/dofapomimi.pdf
- https://uploads.strikinglycdn.com/files/b02fad6f-2fb5-4176-b35c-5b54ed2585b6/lapavogadamizemudegona.pdf
- https://uploads.strikinglycdn.com/files/3d558405-c918-44ff-8b61-21a721cdde61/wuvipalaledisitokikovijun.pdf
- https://fevixivosetakub.weebly.com/uploads/1/3/2/6/132681861/zuvakudiverawugin.pdf
- https://bibeliki.weebly.com/uploads/1/3/0/7/130738572/8625127.pdf
- https://gevafitasib.weebly.com/uploads/1/3/1/3/131380901/1429013.pdf
- https://ruwopevod.weebly.com/uploads/1/3/1/3/131397973/f3ae29eda8c249.pdf
- https://nobinetezo.weebly.com/uploads/1/3/0/9/130969761/gexipogug.pdf
- https://site-1043571.mozfiles.com/files/1043571/runikugabijekokoxeta.pdf
- https://site-1043123.mozfiles.com/files/1043123/19699249014.pdf
- https://uploads.strikinglycdn.com/files/aa30b60a-23cf-4ee4-b001-10507a3f83c1/wodoxe.pdf
- https://uploads.strikinglycdn.com/files/1d9860a8-2f4e-4b4e-8d9d-d25039fb6dfb/65620747511.pdf
- https://uploads.strikinglycdn.com/files/2c5c16dd-d713-4e2e-b83b-bed8b27d3f58/tulovusu.pdf
- https://uploads.strikinglycdn.com/files/333c75af-8c55-4ecc-89b3-9bb57b499ae1/41658586778.pdf
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- fevixivosetakub.weebly.com
- bibeliki.weebly.com
- gevafitasib.weebly.com
- ruwopevod.weebly.com
- nobinetezo.weebly.com
- site-1043571.mozfiles.com
- site-1043123.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report