SUSPICIOUS — a11d0e9b9.pdf
SUSPICIOUS — a11d0e9b9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100), attributed to the REvil family. 3 of 50 detection engines flagged it.
Identification
- SHA-256:
a2bc2f3c03e1656774f9be93073f3a984495d060ec7d5ee8920aea628f2f6132 - SHA-1:
cd4364f805748db6d1b9d88bd25288d1084c31da - MD5:
4f9ac1958edc43441d007b85b139cc3c - ssdeep:
768:1gGzpDspcdVBHg5PENUbYsnUEDOxgAAOODZt7NVGO1+lZ6pb+etfZxX1j0cWGfVq:mGFYpK/poDXQspiet/XhbfVkV - TLSH:
T16C327DF35093EC8CBB8E6B536DBB1169948DD34D60328A61548C3B2DD4BC9FD6E00662 - Submitted as: a11d0e9b9.pdf
- File type: pdf · Size: 44274 bytes
- Verdict: suspicious (58/100) · Family: REvil
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule
ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://gettraff.ru/wb?keyword=manejo%20de%20ceye, https://cdn.shopify.com/s/files/1/0434/4928/6817/files/cowboys_cap_space_as_of_today.pdf, https://cdn.shopify.com/s/files/1/0436/9465/3595/files/blocker_tie_ring.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=manejo%20de%20ceye
- https://cdn.shopify.com/s/files/1/0434/4928/6817/files/cowboys_cap_space_as_of_today.pdf
- https://cdn.shopify.com/s/files/1/0436/9465/3595/files/blocker_tie_ring.pdf
- https://cdn.shopify.com/s/files/1/0502/6912/6811/files/rerojenuwiwomakegajemos.pdf
- https://cdn.shopify.com/s/files/1/0428/9737/5388/files/perimeter_composite_shapes_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0428/9737/5388/files/14622026856.pdf
- https://uploads.strikinglycdn.com/files/b6c5b461-9f9d-4d28-9e5d-3f27f0f1bc4b/73062666679.pdf
- https://uploads.strikinglycdn.com/files/7bb97c09-2dd3-49af-8fc2-c7ddc4a4afbf/breville_barista_espresso.pdf
- https://uploads.strikinglycdn.com/files/32f58ecb-ff32-470d-9d46-07f54789d8a9/josejujalis.pdf
- https://cdn-cms.f-static.net/uploads/4367645/normal_5f8ab53a7a151.pdf
- https://cdn-cms.f-static.net/uploads/4366375/normal_5f872b87768bf.pdf
- https://cdn-cms.f-static.net/uploads/4365555/normal_5f8739bcb44a1.pdf
- https://cdn-cms.f-static.net/uploads/4384150/normal_5f8e226d9cf45.pdf
- https://cdn.shopify.com/s/files/1/0499/5248/9662/files/the_haunted_band.pdf
- https://cdn.shopify.com/s/files/1/0437/2715/9448/files/dp_airgometer_user_manual.pdf
- https://cdn.shopify.com/s/files/1/0268/7306/9741/files/jurnal_pendidikan_issn.pdf
- https://cdn.shopify.com/s/files/1/0440/7332/0600/files/furedoxigedi.pdf
- https://cdn.shopify.com/s/files/1/0497/1567/5293/files/jaxunevedakitusiju.pdf
- https://uploads.strikinglycdn.com/files/e12c4473-9835-41a2-9708-393df12d69a8/15241697446.pdf
- https://uploads.strikinglycdn.com/files/86471a7e-ba72-4dfc-be51-bec08195f76d/29911254237.pdf
- https://uploads.strikinglycdn.com/files/e223a0e2-f327-4697-80e9-99cd205b4ea9/1070355864.pdf
- https://uploads.strikinglycdn.com/files/9a801aaf-c418-403e-8ef2-5e114048b786/54897695567.pdf
- https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/31fee7c.pdf
- https://mutazodot.weebly.com/uploads/1/3/0/8/130874237/031cfc2af68.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- gettraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- fodezamu.weebly.com
- mutazodot.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
More REvil samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report