SUSPICIOUS — 93bad484fc.pdf
SUSPICIOUS — 93bad484fc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
bbafc871fecbde39105ec565f154f00afdd3b173cd7bd1a51912cec255960847 - SHA-1:
f191c57c4b7f9f1e1d7569463383daaa68822856 - MD5:
1981dd048b7b7bc369dd0880e3b1c5ee - ssdeep:
1536:PGFvekQLw1Vhyhx5cG5uXmaZJERGGTQC:+FvekD1Vohx5j5u2uJBG1 - TLSH:
T104349DF354A7DC4C3A8B9B43AEF211956049C7496132ABA0588D373CD9BC6BDBF10960 - Submitted as: 93bad484fc.pdf
- File type: pdf · Size: 53762 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=the%20hitchhiker, https://site-1040668.mozfiles.com/files/1040668/mapepavakezolur.pdf, https://site-1036737.mozfiles.com/files/1036737/gewinuwifegug.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=the%20hitchhiker
- https://site-1040668.mozfiles.com/files/1040668/mapepavakezolur.pdf
- https://site-1036737.mozfiles.com/files/1036737/gewinuwifegug.pdf
- https://site-1040427.mozfiles.com/files/1040427/komorigefenabijatoduxugev.pdf
- https://site-1043160.mozfiles.com/files/1043160/kawusikurobenoze.pdf
- https://site-1040675.mozfiles.com/files/1040675/53807672513.pdf
- https://site-1040974.mozfiles.com/files/1040974/78512333065.pdf
- https://site-1038334.mozfiles.com/files/1038334/wijuxofut.pdf
- https://site-1048490.mozfiles.com/files/1048490/29541073683.pdf
- https://site-1038416.mozfiles.com/files/1038416/rakeburozejelixe.pdf
- https://site-1044106.mozfiles.com/files/1044106/17088775762.pdf
- https://uploads.strikinglycdn.com/files/e92d1163-811b-45a3-aeda-1310e4785c4f/bodegop.pdf
- https://uploads.strikinglycdn.com/files/1b07f343-8894-4344-befc-6e6f1ed43472/wafonemalexizubewigid.pdf
- https://uploads.strikinglycdn.com/files/f0cf4301-55fe-4ed9-b044-6195fc72f1e0/82515551598.pdf
- https://uploads.strikinglycdn.com/files/ecc24cfb-c7b4-44c2-8fe5-e265e414ce20/38051628088.pdf
- https://cdn.shopify.com/s/files/1/0496/0986/7431/files/far_from_the_madding_crowd_parents_guide.pdf
- https://cdn.shopify.com/s/files/1/0433/1051/4334/files/4154587240.pdf
- https://cdn.shopify.com/s/files/1/0431/6502/4416/files/google_hangouts_screen_share_with_sound.pdf
- https://cdn.shopify.com/s/files/1/0494/5910/1863/files/poisonous_snakes_of_the_world.pdf
- https://cdn.shopify.com/s/files/1/0464/7603/4198/files/sigowadekikodebalo.pdf
- https://site-1042940.mozfiles.com/files/1042940/96146229097.pdf
- https://site-1038974.mozfiles.com/files/1038974/13588658887.pdf
- https://site-1039753.mozfiles.com/files/1039753/82189656096.pdf
- https://site-1038837.mozfiles.com/files/1038837/56040132200.pdf
- https://site-1038777.mozfiles.com/files/1038777/19855436519.pdf
Embedded domains
- ggtraff.ru
- site-1040668.mozfiles.com
- site-1036737.mozfiles.com
- site-1040427.mozfiles.com
- site-1043160.mozfiles.com
- site-1040675.mozfiles.com
- site-1040974.mozfiles.com
- site-1038334.mozfiles.com
- site-1048490.mozfiles.com
- site-1038416.mozfiles.com
- site-1044106.mozfiles.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- site-1042940.mozfiles.com
- site-1038974.mozfiles.com
- site-1039753.mozfiles.com
- site-1038837.mozfiles.com
- site-1038777.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report