SUSPICIOUS — 87a19c0.pdf
SUSPICIOUS — 87a19c0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
b4f541f508155a9a72dccc46b5109f5d7787246d492d7d124da4ca9ca8cd3a51 - SHA-1:
c47d3b5cace1b1954b4db9af646883608319f3d8 - MD5:
998d4da0efc93a8605f2012a70b9c8b4 - ssdeep:
1536:EGF0pQdGxJy6RrZBWO0BMXILo9uffGpYIL/Z:RF0pE361+uX6fupRt - TLSH:
T11333AFF360A7ED5DBACB6B03ADE720655486C789A176E7601888272CD07C3BDBF50811 - Submitted as: 87a19c0.pdf
- File type: pdf · Size: 50034 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=big%20daddy, https://site-1038709.mozfiles.com/files/1038709/47969413124.pdf, https://site-1040374.mozfiles.com/files/1040374/pajolexopepelipir.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=big%20daddy
- https://site-1038709.mozfiles.com/files/1038709/47969413124.pdf
- https://site-1040374.mozfiles.com/files/1040374/pajolexopepelipir.pdf
- https://site-1042844.mozfiles.com/files/1042844/99219034387.pdf
- https://cdn.shopify.com/s/files/1/0428/2171/4079/files/asdk12_google_docs_login.pdf
- https://cdn.shopify.com/s/files/1/0482/6903/3633/files/56494185248.pdf
- https://cdn.shopify.com/s/files/1/0486/4154/0254/files/harlem_renaissance_musicians_list.pdf
- https://cdn.shopify.com/s/files/1/0432/8056/4392/files/gafivu.pdf
- https://cdn.shopify.com/s/files/1/0266/8321/1975/files/cary_chinese_school_calendar.pdf
- https://cdn.shopify.com/s/files/1/0430/7537/1159/files/bepuxe.pdf
- https://cdn.shopify.com/s/files/1/0433/9361/3989/files/lakawatakobovo.pdf
- https://cdn.shopify.com/s/files/1/0435/3379/5477/files/the_gnostic_gospel_of_thomas.pdf
- https://cdn.shopify.com/s/files/1/0431/2137/7434/files/manual_troy_bilt_pressure_washer.pdf
- https://cdn.shopify.com/s/files/1/0437/7598/3778/files/66118954099.pdf
- https://cdn.shopify.com/s/files/1/0496/2494/0708/files/33198507083.pdf
- https://cdn.shopify.com/s/files/1/0483/8696/5672/files/mesojisidudikavizokujiza.pdf
- https://cdn.shopify.com/s/files/1/0431/4837/8280/files/24687488542.pdf
- https://site-1041761.mozfiles.com/files/1041761/77012220062.pdf
- https://site-1039350.mozfiles.com/files/1039350/39615878430.pdf
- https://site-1038975.mozfiles.com/files/1038975/25879279651.pdf
- https://site-1043094.mozfiles.com/files/1043094/nuwok.pdf
- https://site-1041613.mozfiles.com/files/1041613/goxonulowatun.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- site-1038709.mozfiles.com
- site-1040374.mozfiles.com
- site-1042844.mozfiles.com
- cdn.shopify.com
- site-1041761.mozfiles.com
- site-1039350.mozfiles.com
- site-1038975.mozfiles.com
- site-1043094.mozfiles.com
- site-1041613.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report