SUSPICIOUS — ee6c82.pdf
SUSPICIOUS — ee6c82.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
ae973cd29cbce93b67ecb108d39e10f13b740ec331225c08196316ba55972230 - SHA-1:
a2ac6d838005f83d34dd6728d321c233df1311e0 - MD5:
7b0fc8ad7dcefdf1a36d789886556d6b - ssdeep:
1536:OGF+pwguNHfGLxn/nFZ3nXMGgd/p8lf2td/+2J8n:3F+pwDpfU/nFZML/p8RGRq - TLSH:
T19C369DF311A7ED8C7E8B3F17EEFB1159608AD78CA166935054482B6CD0786ED3E10A21 - Submitted as: ee6c82.pdf
- File type: pdf · Size: 63931 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=encyclopedia%20of%20medicinal%20plants%20pdf, https://uploads.strikinglycdn.com/files/44275827-128f-4cc9-b86e-61b9b8b85b08/92743227246.pdf, https://uploads.strikinglycdn.com/files/90792129-485d-47f3-87b0-196f743c49a8/danigozagoxuzoxax.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=encyclopedia%20of%20medicinal%20plants%20pdf
- https://uploads.strikinglycdn.com/files/44275827-128f-4cc9-b86e-61b9b8b85b08/92743227246.pdf
- https://uploads.strikinglycdn.com/files/90792129-485d-47f3-87b0-196f743c49a8/danigozagoxuzoxax.pdf
- https://uploads.strikinglycdn.com/files/c83e413d-12d9-4cf7-90ab-b98075f1221d/kizulajanoruf.pdf
- https://uploads.strikinglycdn.com/files/41a8a42d-a04a-4e6e-9bc4-015a977f2341/xetanurinog.pdf
- https://site-1039675.mozfiles.com/files/1039675/jexikeguba.pdf
- https://site-1043042.mozfiles.com/files/1043042/litetiwubusevar.pdf
- https://site-1042788.mozfiles.com/files/1042788/37641326822.pdf
- https://site-1039612.mozfiles.com/files/1039612/16666380239.pdf
- https://site-1040977.mozfiles.com/files/1040977/63482466249.pdf
- https://site-1039446.mozfiles.com/files/1039446/99617520367.pdf
- https://site-1039834.mozfiles.com/files/1039834/93200248995.pdf
- https://site-1041483.mozfiles.com/files/1041483/microsoft_visual_studio_android_app.pdf
- https://site-1048205.mozfiles.com/files/1048205/27716242214.pdf
- https://gusumadanu.weebly.com/uploads/1/3/2/6/132695601/0888efd709fa9.pdf
- https://kufazijofiw.weebly.com/uploads/1/3/0/7/130776126/jaxozezagagatape.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/9276785.pdf
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/xelikanotuzifaja.pdf
- https://cdn.shopify.com/s/files/1/0433/8191/5802/files/laramie_zip_code_uw.pdf
- https://cdn.shopify.com/s/files/1/0483/9561/6407/files/la_coronilla_a_la_divina_misericordia_de_televid.pdf
- https://site-1039307.mozfiles.com/files/1039307/bewilofevuvawepirakijos.pdf
- https://site-1042205.mozfiles.com/files/1042205/robuvosaditivizimuxurud.pdf
- https://site-1037124.mozfiles.com/files/1037124/sakazomuza.pdf
- https://site-1040298.mozfiles.com/files/1040298/99313941900.pdf
- https://site-1039311.mozfiles.com/files/1039311/zubozavukagok.pdf
Embedded domains
- ggtraff.ru
- uploads.strikinglycdn.com
- site-1039675.mozfiles.com
- site-1043042.mozfiles.com
- site-1042788.mozfiles.com
- site-1039612.mozfiles.com
- site-1040977.mozfiles.com
- site-1039446.mozfiles.com
- site-1039834.mozfiles.com
- site-1041483.mozfiles.com
- site-1048205.mozfiles.com
- gusumadanu.weebly.com
- kufazijofiw.weebly.com
- dutitujazekap.weebly.com
- fijojonibiw.weebly.com
- cdn.shopify.com
- site-1039307.mozfiles.com
- site-1042205.mozfiles.com
- site-1037124.mozfiles.com
- site-1040298.mozfiles.com
- site-1039311.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report