SUSPICIOUS — 05d953f2095.pdf

SUSPICIOUS — 05d953f2095.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: ba8e7d14fe8b0f774821e041933d3922fa64d40240e483e6005ab1e0d4d5818c
• SHA-1: 74939f9f3ee53685c879eefe0fd3640b8d39c1b4
• MD5: d2867882b24f017d04724e8b79199717
• ssdeep: 1536:PGFspYVFtuEXTmNotul3t+iKv1YhBZ08QPNOgr:+FspaFtuOmKtuhYv1Y28QP7r
• TLSH: T1E733BEF35157EC4C7E8BAB076ABA24156188878C7237A6A094D8777CD5BC2BCBE11430
• Submitted as: 05d953f2095.pdf
• File type: pdf · Size: 51126 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/wb?keyword=detector%20and%20demodulator%20circuits%20pdf, https://vaferomesab.weebly.com/uploads/1/3/4/3/134351928/kolibaridewanixisu.pdf, https://satobolusiv.weebly.com/uploads/1/3/1/3/131398412/5e82f59a.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/wb?keyword=detector%20and%20demodulator%20circuits%20pdf
• https://s3.amazonaws.com/wilugugo/42855664872.pdf
• https://s3.amazonaws.com/vedexajawo/kimemasejewirigewefel.pdf
• https://s3.amazonaws.com/mejifavo/bexikiveva.pdf
• https://s3.amazonaws.com/gopuze/wedufalapijikeravikibeza.pdf
• https://vaferomesab.weebly.com/uploads/1/3/4/3/134351928/kolibaridewanixisu.pdf
• https://satobolusiv.weebly.com/uploads/1/3/1/3/131398412/5e82f59a.pdf
• https://naxesitigas.weebly.com/uploads/1/3/0/7/130740165/d6a726f.pdf
• https://s3.amazonaws.com/jupevuxirapi/factores_de_riesgo_definicion.pdf
• https://s3.amazonaws.com/jamokaroxoj/30112025624.pdf
• https://s3.amazonaws.com/lupuvogotog/eclipse_aspectj.pdf
• https://s3.amazonaws.com/jamokaroxoj/calendario_serie_a_2019_20_download.pdf
• https://cdn.shopify.com/s/files/1/0266/8124/5879/files/iron_rich_foods_handout.pdf
• https://cdn.shopify.com/s/files/1/0484/6996/7013/files/12626138923.pdf
• https://pavowojavujide.weebly.com/uploads/1/3/1/3/131398322/tekorowudem.pdf
• https://mapipuluzobeb.weebly.com/uploads/1/3/1/3/131398440/aa6e82.pdf
• https://s3.amazonaws.com/tamobalasu/75030686564.pdf
• https://s3.amazonaws.com/fedufiporara/70881865717.pdf
• https://s3.amazonaws.com/gupuso/advanced_adjectives_exercises.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• s3.amazonaws.com
• vaferomesab.weebly.com
• satobolusiv.weebly.com
• naxesitigas.weebly.com
• cdn.shopify.com
• pavowojavujide.weebly.com
• mapipuluzobeb.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report