SUSPICIOUS — 3149734.pdf
SUSPICIOUS — 3149734.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
d2843af3de9b55b905b5567924a8b484e1931c1c75617a91052d6b02cbfe7f4d - SHA-1:
37c89cab960441195236dff07c3af01e1af98a7e - MD5:
8b4aff422c792dd78763e8ad21a1c2d6 - ssdeep:
768:1gGzpD0eJdk+ZvAgwiiyS+JEjNCPJ1aBEzB+HbvuFBXeDqru8DCb3zhxyJv2W00:mGFAeM2SBMBaKBXO8uFDzhuv2W00 - TLSH:
T1DB339DF39093DC4DBB8A9B03ACBA2568658ED74C613797A059C8772CC4BC6AC6E44810 - Submitted as: 3149734.pdf
- File type: pdf · Size: 49510 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=nexos%20national%20bank, https://cdn-cms.f-static.net/uploads/4387430/normal_5f8ec05e4dee1.pdf, https://cdn-cms.f-static.net/uploads/4387571/normal_5f8f18cbc49a2.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=nexos%20national%20bank
- https://cdn-cms.f-static.net/uploads/4387430/normal_5f8ec05e4dee1.pdf
- https://cdn-cms.f-static.net/uploads/4387571/normal_5f8f18cbc49a2.pdf
- https://cdn-cms.f-static.net/uploads/4380681/normal_5f8e1d0a43f29.pdf
- https://cdn-cms.f-static.net/uploads/4374374/normal_5f90a53c6967d.pdf
- https://cdn-cms.f-static.net/uploads/4369311/normal_5f8bb69241ea6.pdf
- https://cdn-cms.f-static.net/uploads/4369802/normal_5f88289415ff4.pdf
- https://cdn-cms.f-static.net/uploads/4370068/normal_5f88de08aac02.pdf
- https://s3.amazonaws.com/mijedusovineti/integration_of_hyperbolic_functions.pdf
- https://s3.amazonaws.com/leguvefu/85250286794.pdf
- https://s3.amazonaws.com/felasorarabipis/36166527878.pdf
- https://s3.amazonaws.com/xanebavifamopez/40500070672.pdf
- https://s3.amazonaws.com/buxoparadazegu/cost_accounting_exercises.pdf
- https://cdn-cms.f-static.net/uploads/4373516/normal_5f90ab5cad070.pdf
- https://cdn-cms.f-static.net/uploads/4368226/normal_5f8b4b9e92fea.pdf
- https://cdn-cms.f-static.net/uploads/4365539/normal_5f890adb2f04e.pdf
- https://cdn-cms.f-static.net/uploads/4370989/normal_5f8902857dd78.pdf
- https://cdn-cms.f-static.net/uploads/4366020/normal_5f874e627b25b.pdf
- https://cdn-cms.f-static.net/uploads/4367642/normal_5f8c28a896f79.pdf
- https://dudikojegak.weebly.com/uploads/1/3/1/4/131406444/jovew_mokeza.pdf
- https://suludizivot.weebly.com/uploads/1/3/1/3/131383823/38c53d6a690.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- s3.amazonaws.com
- dudikojegak.weebly.com
- suludizivot.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report