SUSPICIOUS — 3cfa2bd784c6a.pdf
SUSPICIOUS — 3cfa2bd784c6a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
d971e477c5a068e88106e10dcd4e39893d6ec0967a23fb7b1b07c7ca8b6a3605 - SHA-1:
1f6832c363a96e21330efcbca83662ce600781fc - MD5:
2c7737893e2c784786954e20210cea80 - ssdeep:
768:sgGzpDKpQpul60pETxUx70CGY5YFlZe2Mfjv0ZCSnFFWNZ:pGFGpip3YK8fjvc3DWNZ - TLSH:
T153317BF30093ED4CBA8BAB43A9AB1289518DD3887237D750558CBB6DC47C6AD7F10860 - Submitted as: 3cfa2bd784c6a.pdf
- File type: pdf · Size: 42372 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=el%20se%C3%B1or%20nos%20llama%20y%20nos%20reune, https://xuvakaxatal.weebly.com/uploads/1/3/1/0/131070170/xurerol.pdf, https://gukepofefefika.weebly.com/uploads/1/3/1/4/131437977/7a1ac83a789.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=el%20se%C3%B1or%20nos%20llama%20y%20nos%20reune
- https://xuvakaxatal.weebly.com/uploads/1/3/1/0/131070170/xurerol.pdf
- https://gukepofefefika.weebly.com/uploads/1/3/1/4/131437977/7a1ac83a789.pdf
- https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/jixidused.pdf
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/kirorafagosox.pdf
- https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/4102594.pdf
- https://uploads.strikinglycdn.com/files/9c4f0806-8865-4cf5-a813-b995d7ee38d6/kemenaposatujadovetusasuj.pdf
- https://uploads.strikinglycdn.com/files/1732b4dd-d0e8-479c-bc99-50d1f755729f/nuzizejezuwil.pdf
- https://uploads.strikinglycdn.com/files/f5db48c0-a958-4a84-82f3-2b1ea94acc7b/pawigatowefidexo.pdf
- https://uploads.strikinglycdn.com/files/fecb3299-307e-496b-ba12-5e2f34f11545/jetozovil.pdf
- https://uploads.strikinglycdn.com/files/fcc090c3-60c1-48f6-a188-2bd9de9a2994/buvim.pdf
- https://uploads.strikinglycdn.com/files/bc3f3ce6-e574-4a4e-a72e-3e0509bdc06f/21148735401.pdf
- https://uploads.strikinglycdn.com/files/a9b45110-655c-4f17-bb11-5d42718dfbeb/22799121585.pdf
- https://uploads.strikinglycdn.com/files/521d52e8-de33-4ed1-86b9-33444e6d2c9d/94232109697.pdf
- https://cdn.shopify.com/s/files/1/0499/1837/8152/files/section_10.1_volcanoes_and_plate_tectonics_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0482/2781/1485/files/skyrim_xbox_mod_load_order_2020.pdf
- https://cdn.shopify.com/s/files/1/0499/8073/5648/files/33668140182.pdf
- https://cdn.shopify.com/s/files/1/0498/0388/6755/files/acceleration_calculations_worksheet.pdf
- https://site-1042355.mozfiles.com/files/1042355/23900954564.pdf
- https://site-1036886.mozfiles.com/files/1036886/63509071128.pdf
- https://site-1038421.mozfiles.com/files/1038421/23596596123.pdf
- https://site-1042657.mozfiles.com/files/1042657/59547716225.pdf
- https://site-1039565.mozfiles.com/files/1039565/32365162032.pdf
- https://cdn-cms.f-static.net/uploads/4366034/normal_5f8700c206f99.pdf
- https://cdn-cms.f-static.net/uploads/4366668/normal_5f872bddb7877.pdf
Embedded domains
- gettraff.ru
- xuvakaxatal.weebly.com
- gukepofefefika.weebly.com
- jatorogerujew.weebly.com
- gimejexoxixaza.weebly.com
- mogilifus.weebly.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- site-1042355.mozfiles.com
- site-1036886.mozfiles.com
- site-1038421.mozfiles.com
- site-1042657.mozfiles.com
- site-1039565.mozfiles.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report