SUSPICIOUS — 6799064.pdf
SUSPICIOUS — 6799064.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
db8419e477b890da2017561fbcaf4d19751baa2f4f96663b423787b1e90b53e2 - SHA-1:
0d10c450227f10807e6aeaf288c6810fc62fab0c - MD5:
908fff0b04ae9855c3683f54e0f89e87 - ssdeep:
768:pgGzpDPMkSHVbXgWQMV/brgtedYEHQrEgh5bZRwSN/pSkzTzsFFR+W/rm:KGF7szgoFbjhwrTrRwSJpjz+FR+W/rm - TLSH:
T114329DF351BBED8C7E8BBB07A9EB1588614AD38D303696A04888367DC06C5FD6E01950 - Submitted as: 6799064.pdf
- File type: pdf · Size: 44779 bytes
- Verdict: suspicious (58/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/280a5c2c-e5ba-42a7-b2b6-7783ba102af3/kemogodiloporajikatevanag.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=boost%20converter%20tutorial%20pdf, https://cdn-cms.f-static.net/uploads/4381740/normal_5f9006816465e.pdf, https://cdn-cms.f-static.net/uploads/4366305/normal_5f89080a2acf8.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=boost%20converter%20tutorial%20pdf
- https://cdn-cms.f-static.net/uploads/4381740/normal_5f9006816465e.pdf
- https://cdn-cms.f-static.net/uploads/4366305/normal_5f89080a2acf8.pdf
- https://cdn-cms.f-static.net/uploads/4405953/normal_5f92597891ad6.pdf
- https://uploads.strikinglycdn.com/files/5a89985f-4b58-43ef-ba11-dae30a419731/36797213775.pdf
- https://uploads.strikinglycdn.com/files/280a5c2c-e5ba-42a7-b2b6-7783ba102af3/kemogodiloporajikatevanag.pdf
- https://s3.amazonaws.com/kulinisokakewi/types_of_bioassay.pdf
- https://s3.amazonaws.com/wonoti/indian_food_calorie_chart_for_weight_loss.pdf
- https://uploads.strikinglycdn.com/files/07a030da-66f8-4483-8625-dd61a971c5b5/physics_of_the_atmosphere_and_climate.pdf
- https://uploads.strikinglycdn.com/files/97166ec5-6e0f-49d6-81a6-1d8c05b082f1/element_3d_1.6_crack_download.pdf
- https://uploads.strikinglycdn.com/files/1e2ec6b9-e011-4868-bffa-899632f7a88b/34042748702.pdf
- https://uploads.strikinglycdn.com/files/2eabb6a6-0542-4aab-b7f8-8f8a3a059c04/tajiteke.pdf
- https://uploads.strikinglycdn.com/files/73a8f0b8-7882-4bc8-a966-e2157c191dcc/manual_de_html5_en_espaol.pdf
- https://uploads.strikinglycdn.com/files/af718356-4b45-43ea-8d3c-b048491736eb/david_icke_phantom_self.pdf
- https://uploads.strikinglycdn.com/files/bd281105-fbee-4dee-81f8-e10ea09444c9/jabeluputoduwovemibanewi.pdf
- https://uploads.strikinglycdn.com/files/c26c9fd1-b19c-44d4-870d-0056d0407b26/91130549245.pdf
- https://uploads.strikinglycdn.com/files/516f70e0-89af-4e93-a989-f2fa0343c237/vaxibudirutulul.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report