SUSPICIOUS — sizafe.pdf
SUSPICIOUS — sizafe.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
b399574e9e0bc37ecc13ffc94f445a43c169fa67e7747988516eb08f06d6aea9 - SHA-1:
e833a3442075b12ab5ba5cde361c6fa13d032128 - MD5:
c31be1b7ad6861f225021ce2f3886784 - ssdeep:
768:/gGzpDLp6REHOV+0jJ5qsU8Wyd/wnlGCBWblI6/zcAn1t43QoxQ:IGFvp6R/U8WyinlGCBWBTcC43QoxQ - TLSH:
T1DD328DF35097ED8DBF8BAF039EA71068618AD24D6136975048C83B6CC4BC6ED2F51621 - Submitted as: sizafe.pdf
- File type: pdf · Size: 45598 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=city%20car%20driving%20simulator%20download%20free%20pc%20highly%20compressed, https://site-1042711.mozfiles.com/files/1042711/tubaxuxo.pdf, https://site-1045392.mozfiles.com/files/1045392/zemapipaluwiguwidukix.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=city%20car%20driving%20simulator%20download%20free%20pc%20highly%20compressed
- https://site-1042711.mozfiles.com/files/1042711/tubaxuxo.pdf
- https://site-1045392.mozfiles.com/files/1045392/zemapipaluwiguwidukix.pdf
- https://site-1043176.mozfiles.com/files/1043176/pexerisalika.pdf
- https://site-1048550.mozfiles.com/files/1048550/44113947179.pdf
- https://uploads.strikinglycdn.com/files/2f0458a0-77a4-4d55-bea1-6b703371dd11/18779949236.pdf
- https://uploads.strikinglycdn.com/files/0c2f384b-501d-415d-a195-61086e83495a/8434980919.pdf
- https://uploads.strikinglycdn.com/files/5795ec3b-02f0-4acf-a87e-1877e3f36875/266298014.pdf
- https://site-1043258.mozfiles.com/files/1043258/vesumizixipupirufesamepim.pdf
- https://site-1037240.mozfiles.com/files/1037240/dexuzoriwokevoruxegunid.pdf
- https://cdn-cms.f-static.net/uploads/4365662/normal_5f87d94313724.pdf
- https://cdn-cms.f-static.net/uploads/4367005/normal_5f874320af289.pdf
- https://uploads.strikinglycdn.com/files/bcb53cb5-814f-4163-b443-b4cb722728d1/pesolite.pdf
- https://uploads.strikinglycdn.com/files/3982486e-65d1-4577-8233-922aa5c72942/30429658827.pdf
- https://uploads.strikinglycdn.com/files/e2483845-68a5-4c99-b9be-b2c69d26e714/14967806226.pdf
- https://uploads.strikinglycdn.com/files/17a0d9bf-3951-4c29-ab53-cac570e5d3df/60188871208.pdf
- https://uploads.strikinglycdn.com/files/8dab2eda-b4dd-40c0-8734-86bf1b517013/vukubivoxesekoxuboroxubek.pdf
- https://cdn-cms.f-static.net/uploads/4366063/normal_5f87320095ed3.pdf
- https://cdn-cms.f-static.net/uploads/4366306/normal_5f871afc5519b.pdf
- https://cdn-cms.f-static.net/uploads/4365655/normal_5f870c8fceb76.pdf
- https://cdn-cms.f-static.net/uploads/4365661/normal_5f8772223aea2.pdf
- https://cdn-cms.f-static.net/uploads/4365657/normal_5f87c0043c632.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- site-1042711.mozfiles.com
- site-1045392.mozfiles.com
- site-1043176.mozfiles.com
- site-1048550.mozfiles.com
- uploads.strikinglycdn.com
- site-1043258.mozfiles.com
- site-1037240.mozfiles.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report