SUSPICIOUS — 449102.pdf
SUSPICIOUS — 449102.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
a2b4849f9eaf469eb48a53be133af86800283a28208ec223031947805dac7fbd - SHA-1:
970796eab1ea10c6f9e9e94636a53c75e2c9ecec - MD5:
88fdfa8df22b80e2ad9dfb983572b4c2 - ssdeep:
768:LgGzpDpezn4ul2JryKogZ3kscsBknf7lnULSumplnU+wNlie:0GFVezswsOf7lnpu2U+Alie - TLSH:
T106327DF750D3EC8CBBCBAB53ADB604A9658AC7486123A7A0058C773CC57C1AD7E10991 - Submitted as: 449102.pdf
- File type: pdf · Size: 45698 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/73d802a0-f4f5-4124-864b-6fd547b809be/wupevineputawuvorow.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=tarot%20rider%20waite%20book, https://uploads.strikinglycdn.com/files/7047977b-fee4-4a0e-8d19-1f745c8dc493/keludodukabak.pdf, https://uploads.strikinglycdn.com/files/8c6ae8b3-79ea-4f8a-8690-7faa46a9f6ec/doratenuva.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=tarot%20rider%20waite%20book
- https://uploads.strikinglycdn.com/files/7047977b-fee4-4a0e-8d19-1f745c8dc493/keludodukabak.pdf
- https://uploads.strikinglycdn.com/files/8c6ae8b3-79ea-4f8a-8690-7faa46a9f6ec/doratenuva.pdf
- https://uploads.strikinglycdn.com/files/63ee28a8-c6f2-4e71-abe5-ea6c9a7768a3/49962107450.pdf
- https://uploads.strikinglycdn.com/files/fda2ea31-f184-4ce9-9ba1-375213afd6d8/kitabawufavoduvosik.pdf
- https://uploads.strikinglycdn.com/files/e53eabc9-ec59-4b45-8545-f7540f05d0cf/83770841825.pdf
- https://uploads.strikinglycdn.com/files/73d802a0-f4f5-4124-864b-6fd547b809be/wupevineputawuvorow.pdf
- https://uploads.strikinglycdn.com/files/fcc0ddf9-51a2-49a7-902d-fc603f57f735/nobamutigebomezukepiv.pdf
- https://uploads.strikinglycdn.com/files/28d30557-5842-4c29-9a44-a8c731f18246/kaxeb.pdf
- https://cdn.shopify.com/s/files/1/0434/4456/8216/files/craigslist_southern_maryland_for_sale.pdf
- https://cdn.shopify.com/s/files/1/0437/5992/7448/files/kefulujubujubev.pdf
- https://cdn.shopify.com/s/files/1/0266/8963/4491/files/steelers_vs_patriots_history.pdf
- https://cdn.shopify.com/s/files/1/0480/3274/3583/files/adam_and_eve_lyrics_kasey_chambers.pdf
- https://cdn.shopify.com/s/files/1/0266/7613/4082/files/81524150518.pdf
- https://cdn-cms.f-static.net/uploads/4367648/normal_5f8766fd6f7b4.pdf
- https://cdn-cms.f-static.net/uploads/4365638/normal_5f87202b80ed4.pdf
- https://cdn-cms.f-static.net/uploads/4366027/normal_5f8766d4463ea.pdf
- https://site-1039811.mozfiles.com/files/1039811/nupulasemubeforodagud.pdf
- https://site-1039775.mozfiles.com/files/1039775/23453564141.pdf
- https://uploads.strikinglycdn.com/files/65b4eaa6-efd4-4e58-bd44-db3626a087c7/8981744092.pdf
- https://uploads.strikinglycdn.com/files/d8e8639b-b011-435d-8b7d-ad0e437cc019/zurev.pdf
- https://uploads.strikinglycdn.com/files/39d2d92a-9def-4c19-b1c0-153af38a30a3/25106341865.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- cdn-cms.f-static.net
- site-1039811.mozfiles.com
- site-1039775.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report