SUSPICIOUS — 2008_ford_focus_manual_transmission.pdf
SUSPICIOUS — 2008_ford_focus_manual_transmission.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
b9d552be9f08254c332b9ab8e0cbb3ef5df49ee58cc003849f517bae98466d85 - SHA-1:
c573a90e432df6cacd56223748d7f71a11c77554 - MD5:
9e017b0a970f359586a451b6ded62f95 - ssdeep:
768:tgGzpDkpnncwlHu31Z/C5QYU7xaoKiqop62ZqsVpq3LioWxFwH5m8BlN:OGFIpUlKmp3ZqsS+oWxkFlN - TLSH:
T111307CF3609BED8C7A8B9B136DA31595608DC34C6233E7A0198C772CD4BC2BD6E11865 - Submitted as: 2008_ford_focus_manual_transmission.pdf
- File type: pdf · Size: 38266 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/strik?keyword=2008+ford+focus+manual+transmission, https://cdn-cms.f-static.net/uploads/4382960/normal_5f8d4edea7237.pdf, https://cdn-cms.f-static.net/uploads/4381291/normal_5f8cafcdd31a1.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/strik?keyword=2008+ford+focus+manual+transmission
- https://cdn-cms.f-static.net/uploads/4382960/normal_5f8d4edea7237.pdf
- https://cdn-cms.f-static.net/uploads/4381291/normal_5f8cafcdd31a1.pdf
- https://cdn-cms.f-static.net/uploads/4382960/normal_5f8c89a73df46.pdf
- https://cdn-cms.f-static.net/uploads/4379610/normal_5f8ca8c4e9944.pdf
- https://cdn-cms.f-static.net/uploads/4368486/normal_5f8a1533106a6.pdf
- https://cdn-cms.f-static.net/uploads/4366367/normal_5f873b4c5d9c4.pdf
- https://uploads.strikinglycdn.com/files/8d864bd6-d345-423e-8fa1-c145f87e2458/writing_hypothesis_ppt.pdf
- https://uploads.strikinglycdn.com/files/037178ba-fa1f-4023-a393-9cb0132b7dc1/28278582821.pdf
- https://uploads.strikinglycdn.com/files/fd3cb694-2aff-4cf2-8cdd-e0bfa6f1f411/53674727637.pdf
- https://uploads.strikinglycdn.com/files/0f7d68a6-2e67-42ba-919b-bad744ad856b/dokorizitanab.pdf
- https://uploads.strikinglycdn.com/files/bf027da1-3ed8-4893-8026-14f8d1d79400/sopomav.pdf
- https://tunomofezu.weebly.com/uploads/1/3/2/3/132303147/wawesu_xidavu_pawunudug.pdf
- https://nukubutoti.weebly.com/uploads/1/3/2/3/132302768/levifad.pdf
- https://pidofuvu.weebly.com/uploads/1/3/0/7/130739764/612870c76f5b7a.pdf
- https://cdn-cms.f-static.net/uploads/4366003/normal_5f8729d6d8019.pdf
- https://cdn-cms.f-static.net/uploads/4367937/normal_5f8829cf2ab9e.pdf
- https://cdn-cms.f-static.net/uploads/4368250/normal_5f89fb46632a3.pdf
- https://cdn-cms.f-static.net/uploads/4366395/normal_5f8753e8a6ed4.pdf
- https://cdn-cms.f-static.net/uploads/4366993/normal_5f8904acbe816.pdf
- https://cdn-cms.f-static.net/uploads/4365576/normal_5f8743a9ac3d9.pdf
- https://cdn-cms.f-static.net/uploads/4373248/normal_5f8a14b0c400e.pdf
- https://cdn-cms.f-static.net/uploads/4387931/normal_5f8d493cd0ffb.pdf
- https://cdn-cms.f-static.net/uploads/4367944/normal_5f8d3b0a39baf.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- tunomofezu.weebly.com
- nukubutoti.weebly.com
- pidofuvu.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report