SUSPICIOUS — bda029b635.pdf
SUSPICIOUS — bda029b635.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
bb9ae1ef953fecfd1a98fef411e6fffd57b5f8027015897a7389e867d77b8496 - SHA-1:
3651ed01e3365aff33a868e30a1174766e9decf4 - MD5:
59e5aff60e78c3decefb4158fe2089dc - ssdeep:
1536:pGF59tgQGQVLtUwyATWh4JVhsWTsBx20xQBkW27x3Gql5p6hQLgOCqwq:8F5MitUwgeVhEBdxQBC7Btl5p6hQLtj - TLSH:
T1BA39BFF30197DD8D3B8FAF83EEAA1858714AC6982121E65448CD7A7CC07CAFC6E15611 - Submitted as: bda029b635.pdf
- File type: pdf · Size: 92026 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=%D8%A7%D8%AE%D8%AA%D8%A8%D8%A7%D8%B1%20%D9%87%D9%8A%D8%AF%D8%B1%D9%88%D9%83%D8%B3%D9%8A%D8%AF%20%D8%A7%D9%84%D8%A8%D9%88%D8%AA%D8%A7%D8%B3%D9%8A%D9%88%D9%85%20koh, https://uploads.strikinglycdn.com/files/a759c531-6b92-49bd-9cf6-bf20280ab6ad/sofumibasoginubugilatu.pdf, https://uploads.strikinglycdn.com/files/12a186f4-dde5-47f2-ac42-dc231d7a0bf4/konokikuv.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=%D8%A7%D8%AE%D8%AA%D8%A8%D8%A7%D8%B1%20%D9%87%D9%8A%D8%AF%D8%B1%D9%88%D9%83%D8%B3%D9%8A%D8%AF%20%D8%A7%D9%84%D8%A8%D9%88%D8%AA%D8%A7%D8%B3%D9%8A%D9%88%D9%85%20koh
- https://uploads.strikinglycdn.com/files/a759c531-6b92-49bd-9cf6-bf20280ab6ad/sofumibasoginubugilatu.pdf
- https://uploads.strikinglycdn.com/files/12a186f4-dde5-47f2-ac42-dc231d7a0bf4/konokikuv.pdf
- https://uploads.strikinglycdn.com/files/4d52ffbc-bed9-4ee3-9e7a-df3e46b635e7/nijed.pdf
- https://uploads.strikinglycdn.com/files/c41f06ae-dbbf-4762-8c29-fe826b42654c/binegugevelugebogapa.pdf
- https://cdn.shopify.com/s/files/1/0480/9631/3508/files/90956293059.pdf
- https://cdn.shopify.com/s/files/1/0268/8267/0769/files/apk_pure_games_action.pdf
- https://cdn.shopify.com/s/files/1/0481/6322/5767/files/download_game_simcity_mod_apk_offline_terbaru.pdf
- https://cdn.shopify.com/s/files/1/0432/6791/5936/files/high_sea_saga_mod_apk_latest_version.pdf
- https://s3.amazonaws.com/gupuso/pewepu.pdf
- https://s3.amazonaws.com/tetazino/collagenase_ointment_davis.pdf
- https://s3.amazonaws.com/zirojopemup/jawowuvijesarenuwuzim.pdf
- https://s3.amazonaws.com/wonoti/gitozixofamazisekix.pdf
- https://s3.amazonaws.com/pazifetanegapu/vabudofudi.pdf
- https://uploads.strikinglycdn.com/files/5c613098-6e19-45d2-9f76-e33ccfe9eb07/73328347136.pdf
- https://uploads.strikinglycdn.com/files/a18aeb49-295d-4f53-83b7-43793c21991e/80858971127.pdf
- https://uploads.strikinglycdn.com/files/e4f8797c-dd25-4ee5-a24c-4c3f02148d65/jafigesup.pdf
- https://cdn-cms.f-static.net/uploads/4374983/normal_5f8a49bbbb89d.pdf
- https://cdn-cms.f-static.net/uploads/4366402/normal_5f872f778abc9.pdf
- https://uploads.strikinglycdn.com/files/caf610b4-bae1-4db4-9d54-a9cd9aa34581/zizawowadovodepidemuwe.pdf
- https://uploads.strikinglycdn.com/files/77812ca1-c2d5-4391-9659-03be57176ceb/13734757859.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ggtraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- s3.amazonaws.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report