SUSPICIOUS — 0e069f.pdf
SUSPICIOUS — 0e069f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
b18c1989eece12b28673a6980f4fb53a91202f592eae615fe19e137473487b73 - SHA-1:
fe3dbef9439bf4cea4639ef9909ccd8a8ae69ecf - MD5:
deb4ed3ed7454743277c2e16c268e4b0 - ssdeep:
1536:zGFAexZSYNeJAXx68oFCGPE96QB1qgd87mHS+2fVMolnHHUzqKvWJ5RK8Q:CFAeuYNuABhmE1qiy+aMink18vO - TLSH:
T11A3AD0F350A7FD9C7ECADB93A9DA2459508ADB0862365A24958CB77CC57C37E2F00600 - Submitted as: 0e069f.pdf
- File type: pdf · Size: 101353 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=omc%20saildrive%20service%20manual, https://uploads.strikinglycdn.com/files/5940596e-4b25-403d-903c-4370d702720e/sukoxag.pdf, https://uploads.strikinglycdn.com/files/7fff1416-67e7-4d46-aadb-255a31e601ba/30893608128.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=omc%20saildrive%20service%20manual
- https://uploads.strikinglycdn.com/files/5940596e-4b25-403d-903c-4370d702720e/sukoxag.pdf
- https://uploads.strikinglycdn.com/files/7fff1416-67e7-4d46-aadb-255a31e601ba/30893608128.pdf
- https://uploads.strikinglycdn.com/files/a84028d5-533e-4033-b116-431612dc7d72/zafemijokosumaf.pdf
- https://uploads.strikinglycdn.com/files/65d252e2-1d2e-4c4e-900c-8d7be52db00c/13186405604.pdf
- https://uploads.strikinglycdn.com/files/2ac111a8-0670-4c83-bfb2-1e7654b1d31f/purimegevo.pdf
- https://uploads.strikinglycdn.com/files/bb483103-a1b5-4aad-be76-e90041e431dc/64911041310.pdf
- https://uploads.strikinglycdn.com/files/494bb718-1888-4087-a443-b56b97db7b84/lieutenant_in_german.pdf
- https://uploads.strikinglycdn.com/files/bde03134-8fae-4762-9051-2c156edde74e/dafexoxezeforawele.pdf
- https://uploads.strikinglycdn.com/files/b9713e84-e7ba-4439-ae99-27542739c749/dajivabu.pdf
- https://xuvakaxatal.weebly.com/uploads/1/3/1/0/131070170/potakote.pdf
- https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/7911743.pdf
- https://wivupenoremew.weebly.com/uploads/1/3/0/7/130775018/kotilabivaf_bolusowopunidas_zukozapumi_gefuw.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/pokobu-pidoror-pekirez.pdf
- https://fakimodixoto.weebly.com/uploads/1/3/0/7/130739088/jasoba.pdf
- https://uploads.strikinglycdn.com/files/11e6b9bc-3ddf-4337-8962-4dae2d687ba6/33940548537.pdf
- https://uploads.strikinglycdn.com/files/d490fc10-dbbb-4932-ab44-bbe5ea88a301/60529453364.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/3532345.pdf
- https://zoxaminajoge.weebly.com/uploads/1/3/1/6/131637873/rebakomexusiso_zemagelarew_xituvuf.pdf
- https://jezaxegare.weebly.com/uploads/1/3/1/3/131380636/xelabodiko.pdf
- https://vopevejefed.weebly.com/uploads/1/3/1/6/131606133/6941374.pdf
- https://sifizebutu.weebly.com/uploads/1/3/0/8/130814914/wukujilivaxagu.pdf
- https://jamuseramomuf.weebly.com/uploads/1/3/1/8/131871426/sugole.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- xuvakaxatal.weebly.com
- wepugimi.weebly.com
- wivupenoremew.weebly.com
- zoxuzuxebexot.weebly.com
- fakimodixoto.weebly.com
- zoxaminajoge.weebly.com
- jezaxegare.weebly.com
- vopevejefed.weebly.com
- sifizebutu.weebly.com
- jamuseramomuf.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report