SUSPICIOUS — 0d14666e.pdf
SUSPICIOUS — 0d14666e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
d7cc64b1b403f53f88723d0ca7639fa26c4ceddf1cf218e75c8c58b3b4269d15 - SHA-1:
bae08e7c2920d0650b3c86b690ab5b7e489b5398 - MD5:
cf1d7a356c881c65230ec15f4b8bf838 - ssdeep:
768:ogGzpDP/eLP2m241adrFBpFCpjDS0AnwjXGUwWb1H+lfYIYhRAdKVWD9jfC/tU2m:lGFDEa64lgphidSW9qtBB8vBNxSU - TLSH:
T12B34BFF354D7ED4D7A8B5713ACAA1169A48EC38C72369B6085CC636CD8BC1BDAE11430 - Submitted as: 0d14666e.pdf
- File type: pdf · Size: 56985 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=rosebank%20college%20application%20form%202020%20pdf%20download, https://cdn-cms.f-static.net/uploads/4386829/normal_5f8ebef6e399c.pdf, https://cdn-cms.f-static.net/uploads/4377678/normal_5f8ed1141f9ae.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=rosebank%20college%20application%20form%202020%20pdf%20download
- https://cdn-cms.f-static.net/uploads/4386829/normal_5f8ebef6e399c.pdf
- https://cdn-cms.f-static.net/uploads/4377678/normal_5f8ed1141f9ae.pdf
- https://cdn-cms.f-static.net/uploads/4382770/normal_5f90c9246e440.pdf
- https://cdn-cms.f-static.net/uploads/4373992/normal_5f91882f2b2b3.pdf
- https://cdn-cms.f-static.net/uploads/4379971/normal_5f9097254987b.pdf
- https://cdn-cms.f-static.net/uploads/4368477/normal_5f8decee8dc76.pdf
- https://cdn-cms.f-static.net/uploads/4369797/normal_5f8e268f792d0.pdf
- https://cdn-cms.f-static.net/uploads/4402706/normal_5f91d8838bccd.pdf
- https://cdn-cms.f-static.net/uploads/4379233/normal_5f8b6a8b321ce.pdf
- https://cdn-cms.f-static.net/uploads/4375350/normal_5f91f882a24bf.pdf
- https://cdn-cms.f-static.net/uploads/4384483/normal_5f923c69ba135.pdf
- https://cdn-cms.f-static.net/uploads/4384633/normal_5f8c6dfa68fc0.pdf
- https://cdn-cms.f-static.net/uploads/4367005/normal_5f88aed72164a.pdf
- https://cdn-cms.f-static.net/uploads/4370097/normal_5f8f3ce51ee59.pdf
- https://cdn-cms.f-static.net/uploads/4410204/normal_5f9349e120af9.pdf
- https://cdn-cms.f-static.net/uploads/4379732/normal_5f8ba6b1d99aa.pdf
- https://cdn.shopify.com/s/files/1/0498/7502/6078/files/drastic_ds_emulator_apk_version_2.2.1.2a.pdf
- https://cdn.shopify.com/s/files/1/0497/9097/6162/files/96910514114.pdf
- https://cdn.shopify.com/s/files/1/0430/8611/9079/files/43794587485.pdf
- https://cdn.shopify.com/s/files/1/0440/6332/6358/files/97891615795.pdf
- https://cdn.shopify.com/s/files/1/0500/7153/5774/files/guillermo_del_toro_books_in_order.pdf
- https://uploads.strikinglycdn.com/files/65dd9e36-0fc8-4a6b-8bd4-a4a26a3ebdb1/firidis.pdf
- https://uploads.strikinglycdn.com/files/4fa73bfc-7bdb-403d-bc28-4d825991560e/93365043968.pdf
- https://uploads.strikinglycdn.com/files/3348dd15-f9bb-45b6-9a01-ff341bcb8dea/45212800054.pdf
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report