SUSPICIOUS — 4d22cfd1.pdf
SUSPICIOUS — 4d22cfd1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c0061d099ef2d1ac816408792c0a78d01b519dd6545fd9dbb7635cc6d453ea62 - SHA-1:
44a0130b0a0f529dd702d68dbf769c690662cd9d - MD5:
b1d0aa358112c90e69dc0f556deef1c6 - ssdeep:
768:PgGzpDpp2ryG8scS1kevjGoX78K3muOcAzGMrvvO5ZRcwTcnzLg0pyxqX:4GFNp2cAmdzDrvvO5ZRBAn3g0pCqX - TLSH:
T16E308CF310D7EC4C3B869B13ADA611A9658AC78C62369760549C6B3CC5BC1BDBF01861 - Submitted as: 4d22cfd1.pdf
- File type: pdf · Size: 37510 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://fewevivib.weebly.com/uploads/1/3/0/8/130813821/bepabexobu_xodoxavu_lenusigobu_xadutedid.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=gradeup%20static%20banking%20awareness%20pdf, https://fewevivib.weebly.com/uploads/1/3/0/8/130813821/bepabexobu_xodoxavu_lenusigobu_xadutedid.pdf, https://fobewesepujub.weebly.com/uploads/1/3/2/3/132303403/rewajabegigosumu.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=gradeup%20static%20banking%20awareness%20pdf
- https://fewevivib.weebly.com/uploads/1/3/0/8/130813821/bepabexobu_xodoxavu_lenusigobu_xadutedid.pdf
- https://fobewesepujub.weebly.com/uploads/1/3/2/3/132303403/rewajabegigosumu.pdf
- https://dofazodasi.weebly.com/uploads/1/3/0/8/130873943/tusuz.pdf
- https://kuzaloxamuw.weebly.com/uploads/1/3/1/4/131406684/safiwun_pijoroxu_xurad.pdf
- https://cdn-cms.f-static.net/uploads/4368958/normal_5f8984ffc9bf2.pdf
- https://cdn-cms.f-static.net/uploads/4379054/normal_5f8b7e1c8befc.pdf
- https://cdn-cms.f-static.net/uploads/4366312/normal_5f871a4c6c978.pdf
- https://cdn-cms.f-static.net/uploads/4366385/normal_5f873f6aa5cfc.pdf
- https://winomumamo.weebly.com/uploads/1/3/1/0/131070375/budonegeside-wewewumil-walewe-welazofilekel.pdf
- https://bilewazivabo.weebly.com/uploads/1/3/2/8/132816117/godudewo.pdf
- https://xanodupujariris.weebly.com/uploads/1/3/0/9/130969381/teximajovevogekapad.pdf
- https://jopalezaleloloj.weebly.com/uploads/1/3/1/3/131380469/zarizaxujuzaj_bedike.pdf
- https://lifotuvuzaraxur.weebly.com/uploads/1/3/0/7/130775275/fulipexixobip.pdf
- https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/9653445.pdf
- https://kakawugob.weebly.com/uploads/1/3/0/9/130969990/6652969.pdf
- https://nudojafobedem.weebly.com/uploads/1/3/1/3/131379550/1e853a82f77fdb.pdf
- https://cdn-cms.f-static.net/uploads/4365655/normal_5f8beea7dbb1b.pdf
- https://cdn-cms.f-static.net/uploads/4366369/normal_5f8b97e4f1e78.pdf
- https://cdn-cms.f-static.net/uploads/4382620/normal_5f8c10cdd7ddb.pdf
- https://cdn-cms.f-static.net/uploads/4374976/normal_5f894cd236286.pdf
- https://cdn.shopify.com/s/files/1/0497/0984/2589/files/what_is_quickset64.pdf
- https://cdn.shopify.com/s/files/1/0439/6823/3630/files/40854781270.pdf
- https://cdn.shopify.com/s/files/1/0484/6898/3969/files/32254029753.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- gettraff.ru
- fewevivib.weebly.com
- fobewesepujub.weebly.com
- dofazodasi.weebly.com
- kuzaloxamuw.weebly.com
- cdn-cms.f-static.net
- winomumamo.weebly.com
- bilewazivabo.weebly.com
- xanodupujariris.weebly.com
- jopalezaleloloj.weebly.com
- lifotuvuzaraxur.weebly.com
- vuxozajuje.weebly.com
- kakawugob.weebly.com
- nudojafobedem.weebly.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report