SUSPICIOUS — 5858400.pdf
SUSPICIOUS — 5858400.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
b0cbdd2d4704f7c1d65b3427228a5849312530a9be49d692ef6a5340a55f74c1 - SHA-1:
7d304d08900ac26f13daaa518fdf1d128a7157f1 - MD5:
3c29620218afb404872b66dd96a6885f - ssdeep:
768:QgGzpDWp7qSPP9TC425jhLygu2Scx1UDpWdEVQbSo+ldYiQ6YO/UeKIEwVWCgKa3:9GFSpaU5hYi1XEwVWka2JYjdl - TLSH:
T1B6338DF300A7ED8D7E8B5F43ADA71199614AD78C6132DA91448C2A2CD57C6FD3F00A61 - Submitted as: 5858400.pdf
- File type: pdf · Size: 49286 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=ver%20elysium%20online%20latino, https://cdn.shopify.com/s/files/1/0478/9931/2294/files/unblocked_games_312_super_smash_flash.pdf, https://cdn.shopify.com/s/files/1/0439/2324/3176/files/88934146054.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=ver%20elysium%20online%20latino
- https://cdn.shopify.com/s/files/1/0478/9931/2294/files/unblocked_games_312_super_smash_flash.pdf
- https://cdn.shopify.com/s/files/1/0439/2324/3176/files/88934146054.pdf
- https://cdn.shopify.com/s/files/1/0484/0118/6973/files/64041894112.pdf
- https://cdn.shopify.com/s/files/1/0438/0046/1474/files/wexazurumadifutur.pdf
- https://cdn.shopify.com/s/files/1/0478/2456/8479/files/bugakilitumujeduzaduzuxev.pdf
- https://site-1042354.mozfiles.com/files/1042354/suxanube.pdf
- https://site-1036750.mozfiles.com/files/1036750/gokenugodoz.pdf
- https://site-1038967.mozfiles.com/files/1038967/75509475298.pdf
- https://site-1044103.mozfiles.com/files/1044103/97053187334.pdf
- https://site-1036926.mozfiles.com/files/1036926/28345227389.pdf
- https://cdn-cms.f-static.net/uploads/4367927/normal_5f876895e790d.pdf
- https://cdn-cms.f-static.net/uploads/4365613/normal_5f870b5fe3c7f.pdf
- https://cdn-cms.f-static.net/uploads/4367310/normal_5f874d4607bae.pdf
- https://cdn-cms.f-static.net/uploads/4365589/normal_5f8717b73d3ef.pdf
- https://cdn-cms.f-static.net/uploads/4366632/normal_5f87a4e2b22bf.pdf
- https://cdn.shopify.com/s/files/1/0432/1558/5448/files/what_does_ref_code_s0a00_mean_for_suddenlink.pdf
- https://cdn.shopify.com/s/files/1/0431/0790/9794/files/85228983982.pdf
- https://cdn.shopify.com/s/files/1/0497/1069/4557/files/lotro_champion_legendary_weapon_guide.pdf
- https://cdn.shopify.com/s/files/1/0500/4247/0550/files/jacobs_well_bible_map.pdf
- https://site-1038909.mozfiles.com/files/1038909/lagomikugiwawevot.pdf
- https://site-1042450.mozfiles.com/files/1042450/lalapomawiwozepa.pdf
- https://site-1042266.mozfiles.com/files/1042266/30993886274.pdf
- https://cdn.shopify.com/s/files/1/0266/8085/2670/files/7283768572.pdf
- https://cdn.shopify.com/s/files/1/0435/9467/8435/files/total_wine_return_policy_reddit.pdf
Embedded domains
- gettraff.ru
- cdn.shopify.com
- site-1042354.mozfiles.com
- site-1036750.mozfiles.com
- site-1038967.mozfiles.com
- site-1044103.mozfiles.com
- site-1036926.mozfiles.com
- cdn-cms.f-static.net
- site-1038909.mozfiles.com
- site-1042450.mozfiles.com
- site-1042266.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report