SUSPICIOUS — 74944451222.pdf
SUSPICIOUS — 74944451222.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
dd8973b2961d58ec5e5d165ac55a693de88918497d886c4b0cbfd29119bb9ab0 - SHA-1:
369c6a01eafa578e3209685e9f86bb7723307aff - MD5:
3d053d3fc10f0404775a7ce20482f937 - ssdeep:
768:RgGzpDEeYfJScniz+cqTAZj0JEBDor4Elg04B6zisF8GYrzkfHcEj:iGFQeYpJEBDoRg0nzrF8TQfHcEj - TLSH:
T1F533AEF314A7EE8C6A87AF436CBB25485589C6887136EB600088672DC57C6FCBF10861 - Submitted as: 74944451222.pdf
- File type: pdf · Size: 49582 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=realistas+e+insurgentes, https://cdn.shopify.com/s/files/1/0438/3444/1885/files/avast_regestration_key.pdf, https://cdn.shopify.com/s/files/1/0499/8620/7894/files/51564859357.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/strik?keyword=realistas+e+insurgentes
- https://cdn.shopify.com/s/files/1/0477/4766/1980/files/luzazojogerutawikumusa.pdf
- https://cdn.shopify.com/s/files/1/0438/3444/1885/files/avast_regestration_key.pdf
- https://cdn.shopify.com/s/files/1/0499/8620/7894/files/51564859357.pdf
- https://cdn.shopify.com/s/files/1/0499/1968/8865/files/virtual_families_2_v1.5.0.49_apk__mod_unlimited_money__data_android.pdf
- https://cdn.shopify.com/s/files/1/0501/5709/3029/files/xebenexofog.pdf
- https://site-1043086.mozfiles.com/files/1043086/73548195068.pdf
- https://site-1037129.mozfiles.com/files/1037129/tesagonevibovagipukiriro.pdf
- https://site-1039874.mozfiles.com/files/1039874/bumunelojasedesuvekev.pdf
- https://site-1043288.mozfiles.com/files/1043288/46232414306.pdf
- https://site-1039778.mozfiles.com/files/1039778/tifugelizi.pdf
- https://cdn.shopify.com/s/files/1/0431/4628/1122/files/speed_back_unblocked.pdf
- https://cdn.shopify.com/s/files/1/0501/6443/3061/files/electricity_and_magnetism_study_guide_physical_science.pdf
- https://cdn.shopify.com/s/files/1/0485/3376/6299/files/rodebejotuxesulome.pdf
- https://cdn.shopify.com/s/files/1/0433/9525/2374/files/68264117341.pdf
- https://cdn.shopify.com/s/files/1/0485/7872/4005/files/44428411747.pdf
- https://uploads.strikinglycdn.com/files/aff1f0c6-ec06-414b-9e09-3736abc5217a/pagumatajatilemadurupok.pdf
- https://uploads.strikinglycdn.com/files/1ce7080f-8b0e-42c3-b0da-491c152e82d7/wixuxokaxagelemixigapik.pdf
- https://uploads.strikinglycdn.com/files/a4dfb37a-90cd-4b3b-9524-4e23820f8b3b/kenamu.pdf
- https://uploads.strikinglycdn.com/files/88e7f5d6-f1a2-45cf-adbb-7b4301669bf6/noruzenigek.pdf
- https://uploads.strikinglycdn.com/files/86b215a6-50a3-435a-8067-5e2c963d7e90/deled.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- site-1043086.mozfiles.com
- site-1037129.mozfiles.com
- site-1039874.mozfiles.com
- site-1043288.mozfiles.com
- site-1039778.mozfiles.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report