SUSPICIOUS — 8367681.pdf
SUSPICIOUS — 8367681.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
9f138f0dd40612b6c7b4c4555ad1c73ca9ee14f256391027470d205301db3e2e - SHA-1:
f37fd6d06255fb5240539b4917278d5e0bb127a8 - MD5:
06225adc359c88f5af37e05d0cabc94a - ssdeep:
768:4gGzpDVhpM9mkGWQgZfEbBqUMtyN7tDf6e1CSPytZImFgfPRG7ych6vcO8b03LoI:VGF7pM9NCf6hSPyDF08R4vcdS8wHQrCv - TLSH:
T1F9339EF34467CE8CB547EB43AEA62598544DD2887233E7A0548C772DC4BCAAEBF50421 - Submitted as: 8367681.pdf
- File type: pdf · Size: 48660 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=baf%C3%B6g%20antrag%20formblatt%201%20erkl%C3%A4rung, https://site-1036885.mozfiles.com/files/1036885/77598541052.pdf, https://site-1039229.mozfiles.com/files/1039229/26986557834.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=baf%C3%B6g%20antrag%20formblatt%201%20erkl%C3%A4rung
- https://site-1036885.mozfiles.com/files/1036885/77598541052.pdf
- https://site-1039229.mozfiles.com/files/1039229/26986557834.pdf
- https://site-1039749.mozfiles.com/files/1039749/sree_lalitha_sahasranamam_in_telugu.pdf
- https://site-1043091.mozfiles.com/files/1043091/roroneseraxo.pdf
- https://cdn-cms.f-static.net/uploads/4366374/normal_5f87ebb5ef71a.pdf
- https://cdn-cms.f-static.net/uploads/4365552/normal_5f870128189ca.pdf
- https://cdn-cms.f-static.net/uploads/4366319/normal_5f8712c7d7f45.pdf
- https://cdn-cms.f-static.net/uploads/4365636/normal_5f88056c69143.pdf
- https://cdn-cms.f-static.net/uploads/4366661/normal_5f8772488df57.pdf
- https://cdn-cms.f-static.net/uploads/4366000/normal_5f8714b03d785.pdf
- https://site-1039525.mozfiles.com/files/1039525/91485950660.pdf
- https://site-1042781.mozfiles.com/files/1042781/kisuloziditagegu.pdf
- https://site-1038313.mozfiles.com/files/1038313/22994115782.pdf
- https://site-1040322.mozfiles.com/files/1040322/wezavegutomebo.pdf
- https://cdn.shopify.com/s/files/1/0500/5780/5984/files/red_mill_elementary_school_rating.pdf
- https://cdn.shopify.com/s/files/1/0499/9944/6166/files/mcat_2015_study_schedule_reddit.pdf
- https://cdn.shopify.com/s/files/1/0430/6989/8909/files/algebra_1_module_1_multiple_choice_items_answers.pdf
- https://cdn-cms.f-static.net/uploads/4369774/normal_5f88837d00c6e.pdf
- https://cdn-cms.f-static.net/uploads/4366313/normal_5f871d6fb3add.pdf
- https://cdn-cms.f-static.net/uploads/4369486/normal_5f87e129c67ac.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ggtraff.ru
- site-1036885.mozfiles.com
- site-1039229.mozfiles.com
- site-1039749.mozfiles.com
- site-1043091.mozfiles.com
- cdn-cms.f-static.net
- site-1039525.mozfiles.com
- site-1042781.mozfiles.com
- site-1038313.mozfiles.com
- site-1040322.mozfiles.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report