SUSPICIOUS — c52218.pdf
SUSPICIOUS — c52218.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
cddb6441a2c9a3443de46673d1a5dbd2796abb50ccbb965484efb1e2b3c4f1a3 - SHA-1:
1445c022596ac8ef97cb3da87232c3bbcb437bb1 - MD5:
90daf4825f6e550f8ba058f0c6a473a6 - ssdeep:
768:AgGzpDbpH+LQzyjMC9aDlbZGMmVoH1p9FIWGuY5VbVJUT:NGFXpH+vSpQWG/5VbVJUT - TLSH:
T1FA306BF320E7DD4D7A879B076DAB15A82489C38CA133E790159C3B2DC4BC6AD6F50960 - Submitted as: c52218.pdf
- File type: pdf · Size: 36278 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=bajirao%20full%20movie%20mastani, https://cdn-cms.f-static.net/uploads/4387918/normal_5f8eee4259bc1.pdf, https://cdn-cms.f-static.net/uploads/4368782/normal_5f890abcd51d5.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=bajirao%20full%20movie%20mastani
- https://cdn-cms.f-static.net/uploads/4387918/normal_5f8eee4259bc1.pdf
- https://cdn-cms.f-static.net/uploads/4368782/normal_5f890abcd51d5.pdf
- https://cdn-cms.f-static.net/uploads/4368489/normal_5f893bb962873.pdf
- https://cdn-cms.f-static.net/uploads/4388407/normal_5f8e6c9b35a29.pdf
- https://cdn-cms.f-static.net/uploads/4372360/normal_5f8b626b4b5bc.pdf
- https://pepotoxuxomupav.weebly.com/uploads/1/3/1/4/131483830/56ad63a.pdf
- https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/vupivajuveb.pdf
- https://cdn-cms.f-static.net/uploads/4365606/normal_5f87dc98e2339.pdf
- https://cdn-cms.f-static.net/uploads/4377095/normal_5f8d2a1c62d74.pdf
- https://cdn-cms.f-static.net/uploads/4373516/normal_5f8a876793d25.pdf
- https://cdn-cms.f-static.net/uploads/4383925/normal_5f8e946e0dd36.pdf
- https://uploads.strikinglycdn.com/files/3eb21a1f-199a-492d-a1a5-e16ffe2a4bde/kannukulla_nikkira_en_kadhaliye_song.pdf
- https://uploads.strikinglycdn.com/files/dce10094-73e9-4554-ad79-dd46590536a8/2011476390.pdf
- https://uploads.strikinglycdn.com/files/144ca143-bc45-4fe7-943a-699423f21e62/82494221905.pdf
- https://cdn-cms.f-static.net/uploads/4372682/normal_5f8b0e1d7a7df.pdf
- https://cdn-cms.f-static.net/uploads/4369643/normal_5f89b4b566106.pdf
- https://cdn-cms.f-static.net/uploads/4366965/normal_5f8b1959605d1.pdf
- https://cdn-cms.f-static.net/uploads/4378386/normal_5f8b3263ef013.pdf
- https://cdn-cms.f-static.net/uploads/4374519/normal_5f8a1a3c777a2.pdf
- https://cdn-cms.f-static.net/uploads/4369779/normal_5f8803d5c9c3d.pdf
- https://cdn-cms.f-static.net/uploads/4366044/normal_5f8703711943f.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- pepotoxuxomupav.weebly.com
- wepugimi.weebly.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report