SUSPICIOUS — db23f31239a60.pdf
SUSPICIOUS — db23f31239a60.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
af18f95ab10ecee0177db33e0b4833b4abbfe412d89f864698b848c03c752d7d - SHA-1:
34f38b2e7c13c1598eb3549673f2894c7846d615 - MD5:
5ddf848624830b1f0e9799a6706c2c80 - ssdeep:
768:ygGzpDQjzZ70ld+grKCmxGNDoiBbD549S46eWkkUbQGaXh00ZR3ugEF1g:vGFsku0DiSocIQG+hnR3ugE7g - TLSH:
T146319EF364A7EC8CBB879B47ADAA10655189C28D713AD764048C372DE4BC2BD7E00961 - Submitted as: db23f31239a60.pdf
- File type: pdf · Size: 40362 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/10c53844-f625-41b9-ab78-d3f007c40e5e/givokobovapupu.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=pagsasanay%20sa%20pagbasa%20ng%20abakada%20pdf, https://uploads.strikinglycdn.com/files/10c53844-f625-41b9-ab78-d3f007c40e5e/givokobovapupu.pdf, https://uploads.strikinglycdn.com/files/acc2ae06-b744-4084-a300-f2e60adadac5/voguzebizaj.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=pagsasanay%20sa%20pagbasa%20ng%20abakada%20pdf
- https://uploads.strikinglycdn.com/files/10c53844-f625-41b9-ab78-d3f007c40e5e/givokobovapupu.pdf
- https://uploads.strikinglycdn.com/files/acc2ae06-b744-4084-a300-f2e60adadac5/voguzebizaj.pdf
- https://uploads.strikinglycdn.com/files/4ce7aa63-3b12-4d9f-b41d-6d2703035005/ge_lunar_prodigy_service_manual.pdf
- https://uploads.strikinglycdn.com/files/93471056-3517-4ab3-aea2-4d641f95f558/zizigaronerepopujesem.pdf
- https://cdn-cms.f-static.net/uploads/4367286/normal_5f876829a3298.pdf
- https://cdn.shopify.com/s/files/1/0501/6286/0197/files/gofevutu.pdf
- https://cdn.shopify.com/s/files/1/0436/6077/1481/files/fekedixigizinawovanoguk.pdf
- https://cdn.shopify.com/s/files/1/0266/9586/0399/files/7500728077.pdf
- https://cdn.shopify.com/s/files/1/0481/9098/0253/files/sejajibogoletatixis.pdf
- https://cdn.shopify.com/s/files/1/0480/7832/3876/files/tevakedexomujopax.pdf
- https://cdn-cms.f-static.net/uploads/4372980/normal_5f907f19198e1.pdf
- https://cdn-cms.f-static.net/uploads/4368781/normal_5f8f5ce3a1414.pdf
- https://uploads.strikinglycdn.com/files/1ba81904-f199-4b4b-b330-56085676b26e/79423267831.pdf
- https://uploads.strikinglycdn.com/files/0937b1e5-f6e2-4786-9787-c07488b44b10/diseC3B1o_de_maquinaria_norton_4_edicion_solucionario.pdf
- https://uploads.strikinglycdn.com/files/c86237b1-5107-4dbc-888d-724ca2f2747e/62422539544.pdf
- https://s3.amazonaws.com/kavitokolezub/56287868826.pdf
- https://s3.amazonaws.com/nokiva/banking_chronicle_book.pdf
- https://s3.amazonaws.com/susopuzupure/xofuzuludafoxa.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- cdn.shopify.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report