SUSPICIOUS — ffd0c4e1d9a0fa3.pdf
SUSPICIOUS — ffd0c4e1d9a0fa3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
b56e790dbe0c97e342108b321faa9c5a822d7489de569bcea121b0d84b94e6ae - SHA-1:
247d653d4e6e2bafd0def4ac372b9b66a7f732f6 - MD5:
88eea178e4ef860332c900ad1ff7d5c4 - ssdeep:
768:zgGzpDvpoO3G83UXD+ICx33/loOlN8ryhIc6a+ZxwI1vcc:MGFLpQD0339Jqrqd++Gvcc - TLSH:
T1BA328DF314A7DD8CBB8A8B43AEEB1159508DD78C5172D3508498762EE4BC6BD7E10930 - Submitted as: ffd0c4e1d9a0fa3.pdf
- File type: pdf · Size: 45316 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/baba1fcd-8277-49b8-9a24-f165dff91b73/selabebezevopisinanu.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=cities%20skylines%20campus%20download, https://uploads.strikinglycdn.com/files/baba1fcd-8277-49b8-9a24-f165dff91b73/selabebezevopisinanu.pdf, https://uploads.strikinglycdn.com/files/4ab9dd39-19fa-4e49-8596-c93dad1d71cd/57370872790.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=cities%20skylines%20campus%20download
- https://uploads.strikinglycdn.com/files/baba1fcd-8277-49b8-9a24-f165dff91b73/selabebezevopisinanu.pdf
- https://uploads.strikinglycdn.com/files/4ab9dd39-19fa-4e49-8596-c93dad1d71cd/57370872790.pdf
- https://uploads.strikinglycdn.com/files/d2ad61bf-9bac-4cfa-947e-622f15402970/zanejogoduzimep.pdf
- https://uploads.strikinglycdn.com/files/7d3b4767-b668-4e1f-a1e3-7588c37886f9/57123406335.pdf
- https://uploads.strikinglycdn.com/files/60258fc0-198b-4c7c-8f34-9ec1df2e131c/tigilovuvenerotulak.pdf
- https://site-1042104.mozfiles.com/files/1042104/42120901529.pdf
- https://site-1044453.mozfiles.com/files/1044453/86285668564.pdf
- https://site-1038949.mozfiles.com/files/1038949/38897491889.pdf
- https://site-1039995.mozfiles.com/files/1039995/el_manual_de_ned_moze.pdf
- https://site-1040618.mozfiles.com/files/1040618/wazasukekuwavubemaxifa.pdf
- https://site-1039689.mozfiles.com/files/1039689/88381956124.pdf
- https://site-1039361.mozfiles.com/files/1039361/60116099459.pdf
- https://cdn.shopify.com/s/files/1/0500/5249/7576/files/voxufufunoxexezejizazeg.pdf
- https://cdn.shopify.com/s/files/1/0479/7867/6380/files/zg_survival_hack_apk_download.pdf
- https://cdn.shopify.com/s/files/1/0480/3366/1077/files/39136959533.pdf
- https://site-1044010.mozfiles.com/files/1044010/49092832101.pdf
- https://site-1041782.mozfiles.com/files/1041782/93768695371.pdf
- https://site-1043128.mozfiles.com/files/1043128/vakebo.pdf
- https://site-1042444.mozfiles.com/files/1042444/sebedesuwebuvibesisakim.pdf
- https://site-1048515.mozfiles.com/files/1048515/44864602553.pdf
- https://site-1037122.mozfiles.com/files/1037122/romafiw.pdf
- https://site-1038488.mozfiles.com/files/1038488/dokepaleligixilosutuwi.pdf
- https://site-1036997.mozfiles.com/files/1036997/57479830829.pdf
- https://site-1039753.mozfiles.com/files/1039753/55768937058.pdf
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- site-1042104.mozfiles.com
- site-1044453.mozfiles.com
- site-1038949.mozfiles.com
- site-1039995.mozfiles.com
- site-1040618.mozfiles.com
- site-1039689.mozfiles.com
- site-1039361.mozfiles.com
- cdn.shopify.com
- site-1044010.mozfiles.com
- site-1041782.mozfiles.com
- site-1043128.mozfiles.com
- site-1042444.mozfiles.com
- site-1048515.mozfiles.com
- site-1037122.mozfiles.com
- site-1038488.mozfiles.com
- site-1036997.mozfiles.com
- site-1039753.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report