SUSPICIOUS — db83515512.pdf
SUSPICIOUS — db83515512.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
df31b05c54a376e96c9057e25fbf7d542e7b7f79d27876ccb56d0a5c4c3c7ccb - SHA-1:
aeabb964617bd219717fdffed212971d0fe15907 - MD5:
3af4abc8ace77783b23db8429f154376 - ssdeep:
768:xgGzpDiexDY/G04spI4U590+nmaSyPgbcx7v0T/GcE20MChocyYNw3:CGF+eBzmpyAcxDzceoSNw3 - TLSH:
T190327DF31097DD8CBB8B9B036DFB1169258AC74C6136AB60459C776DD0BC6BD6E00620 - Submitted as: db83515512.pdf
- File type: pdf · Size: 45532 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=andrea%20bocelli%20si%20mp3, https://site-1048265.mozfiles.com/files/1048265/trail_tech_vapor_install_instructions.pdf, https://site-1040387.mozfiles.com/files/1040387/28356518352.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=andrea%20bocelli%20si%20mp3
- https://site-1048265.mozfiles.com/files/1048265/trail_tech_vapor_install_instructions.pdf
- https://site-1040387.mozfiles.com/files/1040387/28356518352.pdf
- https://site-1043055.mozfiles.com/files/1043055/41221388434.pdf
- https://cdn.shopify.com/s/files/1/0495/5045/9032/files/jinusirixopovemimisiwisuw.pdf
- https://cdn.shopify.com/s/files/1/0430/6858/8185/files/epiphone_ea_250_pickguard.pdf
- https://cdn.shopify.com/s/files/1/0476/5850/0262/files/dedusifapik.pdf
- https://cdn.shopify.com/s/files/1/0483/9928/6429/files/arctic_vs_antarctic_weather.pdf
- https://cdn.shopify.com/s/files/1/0430/0632/8995/files/vosiv.pdf
- https://cdn.shopify.com/s/files/1/0482/8161/6546/files/paladin_spell_slots_dnd_5e.pdf
- https://uploads.strikinglycdn.com/files/76bf2d10-7288-4144-8822-6e2061273fa0/mefozekagozemip.pdf
- https://uploads.strikinglycdn.com/files/cf7a5b61-a402-4253-a6e5-e29e93ae5242/11637575560.pdf
- https://uploads.strikinglycdn.com/files/43e5c855-d2f5-4793-8805-eec139203e4e/wawewegozunaraxujujox.pdf
- https://uploads.strikinglycdn.com/files/0f48ca29-0c78-4bf8-b448-75fdec78eb8c/81322329599.pdf
- https://uploads.strikinglycdn.com/files/a910fb8a-5f05-46be-acf5-b89518735b52/66961873714.pdf
- https://site-1040683.mozfiles.com/files/1040683/gememitumum.pdf
- https://site-1037864.mozfiles.com/files/1037864/pipemawepaxinaxuwazupogi.pdf
- https://site-1039610.mozfiles.com/files/1039610/mughal_emperor_history.pdf
- https://site-1043051.mozfiles.com/files/1043051/kanozelavamemusizuvorawu.pdf
- https://cdn-cms.f-static.net/uploads/4367952/normal_5f876f227cfd4.pdf
- https://cdn-cms.f-static.net/uploads/4366055/normal_5f872f157a487.pdf
- https://cdn-cms.f-static.net/uploads/4365601/normal_5f872e0b536f2.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ggtraff.ru
- site-1048265.mozfiles.com
- site-1040387.mozfiles.com
- site-1043055.mozfiles.com
- cdn.shopify.com
- uploads.strikinglycdn.com
- site-1040683.mozfiles.com
- site-1037864.mozfiles.com
- site-1039610.mozfiles.com
- site-1043051.mozfiles.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report