SUSPICIOUS — 1001604.pdf
SUSPICIOUS — 1001604.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
cf91cc4735b0db0d737a935681676f5f02b680fb93985175fd8322a1f24e18a0 - SHA-1:
ae30615ead5cfd0ba6f8dedb252ea4b76ffd0bf5 - MD5:
15433246f84e8f899ef7126ce7483b61 - ssdeep:
768:9gGzpDOppzu7F2tXGnNISNle91FV8eMEoGXGOHUEZjA0h4bxoU+C2r1ULvCSKx1n:+GF6ppAe1V83XGXGOHlZcm4b+9BqFWCg - TLSH:
T15D338EF75497DC8CBA879B136CAA216565CAC3486236D394498CBB3CD4BC2AC7F11C60 - Submitted as: 1001604.pdf
- File type: pdf · Size: 48703 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=manual%20lathe%20machine%20operator%20job%20description, https://nitetezelimon.weebly.com/uploads/1/3/1/4/131438651/fefujewetawasozokadu.pdf, https://pibazafefudo.weebly.com/uploads/1/3/0/7/130776509/zuxevukemin.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=manual%20lathe%20machine%20operator%20job%20description
- https://nitetezelimon.weebly.com/uploads/1/3/1/4/131438651/fefujewetawasozokadu.pdf
- https://pibazafefudo.weebly.com/uploads/1/3/0/7/130776509/zuxevukemin.pdf
- https://nutolifawivu.weebly.com/uploads/1/3/1/4/131437776/muligito.pdf
- https://polabufasol.weebly.com/uploads/1/3/2/8/132814050/4477745d34684.pdf
- https://sukowaletudevux.weebly.com/uploads/1/3/0/8/130874669/5545888.pdf
- https://cdn-cms.f-static.net/uploads/4365553/normal_5f96d81fa7dc6.pdf
- https://cdn-cms.f-static.net/uploads/4369501/normal_5f9034ea042b0.pdf
- https://cdn-cms.f-static.net/uploads/4381081/normal_5f910c2ca7495.pdf
- https://putigazabikikim.weebly.com/uploads/1/3/2/6/132682718/ff3ef9.pdf
- https://lesofetu.weebly.com/uploads/1/3/1/3/131378838/depomogelivaxot.pdf
- https://sifizebutu.weebly.com/uploads/1/3/0/8/130814914/8699562.pdf
- https://fakimodixoto.weebly.com/uploads/1/3/0/7/130739088/gidabavuv.pdf
- https://mumixopid.weebly.com/uploads/1/3/1/8/131872042/kiwajuwowugir-vinegiwe-fagugitana-xajumetotexi.pdf
- https://uploads.strikinglycdn.com/files/ff5b49dc-de3f-4286-ae90-8b6ed148a564/begedubigawolebewene.pdf
- https://uploads.strikinglycdn.com/files/62ab67c3-fc94-442f-8683-1aa0313adf1f/76882115354.pdf
- https://uploads.strikinglycdn.com/files/f7d877d4-f370-454d-b9c0-554eff80ffe6/r_studio_download_plot.pdf
- https://uploads.strikinglycdn.com/files/b85c4db0-27c6-4ed3-aed8-8a297cb1df2e/range_control_fort_drum.pdf
- https://uploads.strikinglycdn.com/files/35213ab7-0b17-45aa-97a3-29927a476077/tukivosisubejagesovalofa.pdf
- https://uploads.strikinglycdn.com/files/bb18ceb5-f93f-44eb-b76c-9bdf966a1448/eneagrama_claudio_naranjo.pdf
- https://cdn-cms.f-static.net/uploads/4366622/normal_5f876437d785d.pdf
- https://cdn-cms.f-static.net/uploads/4366042/normal_5f89a8b5ba0ba.pdf
- https://cdn-cms.f-static.net/uploads/4372721/normal_5f91f367afa95.pdf
- https://cdn-cms.f-static.net/uploads/4371808/normal_5f8d8329b8282.pdf
- https://cdn-cms.f-static.net/uploads/4387932/normal_5f8db5edb212d.pdf
Embedded domains
- gettraff.ru
- nitetezelimon.weebly.com
- pibazafefudo.weebly.com
- nutolifawivu.weebly.com
- polabufasol.weebly.com
- sukowaletudevux.weebly.com
- cdn-cms.f-static.net
- putigazabikikim.weebly.com
- lesofetu.weebly.com
- sifizebutu.weebly.com
- fakimodixoto.weebly.com
- mumixopid.weebly.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report