SUSPICIOUS — 98256.pdf
SUSPICIOUS — 98256.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
c06f51f8948c4477da74350fce6ecff498a77ac3601a610986a667c305217dcb - SHA-1:
d4e8a4f654e694c71bb84b92f77d9ba5a51993cc - MD5:
4316acd6a3ca2602ecb67859b1b92666 - ssdeep:
768:3gGzpDjpRMHkkQ+u4jYmUMF6ztNosTrdWVlmoljM2kzAc3k/YKYNZ/j30aO0BYX7:QGF/ptWKoljM2kzpk/YKYbD/O0BYX7 - TLSH:
T1BC328DF310E3DD4C7E8A9F23ADAB14A9508AD7486037D790498CBA2DC4BC1BD7E10961 - Submitted as: 98256.pdf
- File type: pdf · Size: 43776 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=gogo%20songs%20download, https://cdn-cms.f-static.net/uploads/4373517/normal_5f88d1649bf8c.pdf, https://cdn-cms.f-static.net/uploads/4374840/normal_5f897df447c0d.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=gogo%20songs%20download
- https://cdn-cms.f-static.net/uploads/4373517/normal_5f88d1649bf8c.pdf
- https://cdn-cms.f-static.net/uploads/4374840/normal_5f897df447c0d.pdf
- https://cdn-cms.f-static.net/uploads/4366057/normal_5f8748e4cec80.pdf
- https://cdn-cms.f-static.net/uploads/4366313/normal_5f897bbe10f2e.pdf
- https://cdn-cms.f-static.net/uploads/4367305/normal_5f8763d063381.pdf
- https://uploads.strikinglycdn.com/files/c362f5f2-95f6-444c-a26a-4b42c2164db1/97827136458.pdf
- https://uploads.strikinglycdn.com/files/d20c6710-4689-4f55-89d0-852a9e0d97e4/novesirizesefetonogotoxe.pdf
- https://uploads.strikinglycdn.com/files/eb292950-c35c-46b8-b1d1-579d728d2c86/peratoreted.pdf
- https://cdn.shopify.com/s/files/1/0430/2359/7725/files/yiruma_love_me_sheet_music.pdf
- https://cdn.shopify.com/s/files/1/0429/9853/0201/files/manebinibigutofek.pdf
- https://cdn.shopify.com/s/files/1/0430/3477/1610/files/trileptal_side_effects_sexually.pdf
- https://cdn.shopify.com/s/files/1/0488/9644/2527/files/gupuvufa.pdf
- https://cdn-cms.f-static.net/uploads/4372723/normal_5f8912956703f.pdf
- https://cdn-cms.f-static.net/uploads/4369524/normal_5f8aa4a25f550.pdf
- https://cdn-cms.f-static.net/uploads/4365563/normal_5f87335db99b0.pdf
- https://cdn-cms.f-static.net/uploads/4374520/normal_5f891831be95f.pdf
- https://cdn-cms.f-static.net/uploads/4369903/normal_5f8ab20098fc5.pdf
- https://uploads.strikinglycdn.com/files/d200728c-4e93-4b65-8301-380e9d33819b/menobekaluwopovepufib.pdf
- https://uploads.strikinglycdn.com/files/905814b3-4b46-4cad-abf5-76c57c41a9d1/vusufepizerixi.pdf
- https://uploads.strikinglycdn.com/files/1dff66ec-aaa5-474a-b030-a711bccc6274/koziwodeg.pdf
- https://uploads.strikinglycdn.com/files/791e3981-b523-4903-940d-3b13f7db97e5/bitebowidajilogoxot.pdf
- https://cdn.shopify.com/s/files/1/0486/5212/4328/files/90566535032.pdf
- https://cdn.shopify.com/s/files/1/0268/7795/2169/files/zidalizufesame.pdf
- https://cdn.shopify.com/s/files/1/0500/9552/1957/files/pittsford_credit_union_mortgage_rates.pdf
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report