SUSPICIOUS — 72ad51d33e8c9.pdf
SUSPICIOUS — 72ad51d33e8c9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c299aca3be51605eb579282d7b33f3af64eb41111047c80ae1e9d28b7417fa42 - SHA-1:
99c6eb7a589929c1c4b6f1a9708258d432b14ce2 - MD5:
7fd8992c4f5ba6a4e297a38f08c2a45c - ssdeep:
768:4gGzpDQpRZI2Rqx7JXPdPiBV5xoR2fupE1mVSUNapC7kh1LR6nO37nrR3Ktnu8Af:VGF8p5i2fzmVTQpC4h1LoA7SnpA+o1 - TLSH:
T1AC319EF35497DD4C3A8B9B136DAA14A8348DD68C7236E7A089CC776DC4BC17D6E008A1 - Submitted as: 72ad51d33e8c9.pdf
- File type: pdf · Size: 41981 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/07065dc8-6309-4356-bcd6-bd203728c9c7/sugopixikekisitigirem.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=samantha%20sullivan%20facebook, https://cdn-cms.f-static.net/uploads/4365639/normal_5f86f462378d1.pdf, https://cdn-cms.f-static.net/uploads/4366646/normal_5f87867164cbb.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=samantha%20sullivan%20facebook
- https://cdn-cms.f-static.net/uploads/4365639/normal_5f86f462378d1.pdf
- https://cdn-cms.f-static.net/uploads/4366646/normal_5f87867164cbb.pdf
- https://cdn-cms.f-static.net/uploads/4367286/normal_5f8769218669b.pdf
- https://cdn-cms.f-static.net/uploads/4365580/normal_5f8784abf278c.pdf
- https://cdn-cms.f-static.net/uploads/4366043/normal_5f8723342c7fe.pdf
- https://site-1043571.mozfiles.com/files/1043571/pezakesezak.pdf
- https://uploads.strikinglycdn.com/files/07065dc8-6309-4356-bcd6-bd203728c9c7/sugopixikekisitigirem.pdf
- https://uploads.strikinglycdn.com/files/58aa7f6f-aada-4e44-a1d7-b6b3c5cf1f09/lisujage.pdf
- https://cdn-cms.f-static.net/uploads/4368266/normal_5f87ba270ff7c.pdf
- https://cdn-cms.f-static.net/uploads/4365555/normal_5f87a74fd8363.pdf
- https://cdn-cms.f-static.net/uploads/4365612/normal_5f8723ab4e536.pdf
- https://cdn-cms.f-static.net/uploads/4365635/normal_5f870cd356038.pdf
- https://uploads.strikinglycdn.com/files/d9a21aec-3f82-40cc-8b48-284e97ae3c04/66197337149.pdf
- https://uploads.strikinglycdn.com/files/107219be-ae78-41d4-80e9-62adffc23b29/42891810285.pdf
- https://uploads.strikinglycdn.com/files/3c4f31a3-d631-4747-912e-a1817733ec99/jevilebonogogodiximex.pdf
- https://cdn-cms.f-static.net/uploads/4369173/normal_5f87a1cf9f03f.pdf
- https://cdn-cms.f-static.net/uploads/4368225/normal_5f87a165a6ad5.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f86f834dd332.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- site-1043571.mozfiles.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report