SUSPICIOUS — bubabus.pdf
SUSPICIOUS — bubabus.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
e0ecca46ab5b9670feda00f8d3c2f9cf92e62012c99c37215469a4a5b48af76d - SHA-1:
64822ebcef1b27ec5e2717ef64c72c37a8ac0526 - MD5:
ff5a4495da12114e80370d0509df240f - ssdeep:
768:lgGzpDNpXYCSP84NYU2RCLbFFaNDKQAWKR+ilHng+p3FjBI1BTkuRfvf/y2DNJD/:2GFZpXKM1R3BQFjBI/llDWjLQ - TLSH:
T18E337DF350A7ED4C7B8B6F07ADA7116DA08ED24C6122A7A04098772DC17C6FD3E509A1 - Submitted as: bubabus.pdf
- File type: pdf · Size: 49150 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=2000%20years%20later%20spongebob, https://cdn-cms.f-static.net/uploads/4368223/normal_5f8a5bf1ee21a.pdf, https://cdn-cms.f-static.net/uploads/4366654/normal_5f87655a32bcb.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=2000%20years%20later%20spongebob
- https://cdn-cms.f-static.net/uploads/4368223/normal_5f8a5bf1ee21a.pdf
- https://cdn-cms.f-static.net/uploads/4366654/normal_5f87655a32bcb.pdf
- https://cdn-cms.f-static.net/uploads/4370266/normal_5f88f2276d56c.pdf
- https://cdn-cms.f-static.net/uploads/4366978/normal_5f8738bfbb389.pdf
- https://uploads.strikinglycdn.com/files/919a0c86-02c9-4a9c-87fe-15094156a057/82811335974.pdf
- https://uploads.strikinglycdn.com/files/e0893cb6-3beb-43ad-9618-8fda47ca0c35/47964662423.pdf
- https://uploads.strikinglycdn.com/files/2a016cb7-7faf-410f-a5a5-0d95b8d900f5/jipijexo.pdf
- https://cdn-cms.f-static.net/uploads/4369505/normal_5f8932f878a59.pdf
- https://cdn-cms.f-static.net/uploads/4365661/normal_5f86f79e52b86.pdf
- https://cdn-cms.f-static.net/uploads/4366336/normal_5f875964d7546.pdf
- https://cdn-cms.f-static.net/uploads/4371505/normal_5f8b62c2c082c.pdf
- https://cdn-cms.f-static.net/uploads/4366335/normal_5f875ebb5ede2.pdf
- https://cdn.shopify.com/s/files/1/0434/1887/8104/files/wood_roof_construction.pdf
- https://cdn.shopify.com/s/files/1/0439/4916/2654/files/aroma_rice_cooker_instructions_4_cup.pdf
- https://cdn.shopify.com/s/files/1/0500/3028/0864/files/32601953948.pdf
- https://uploads.strikinglycdn.com/files/df1640b2-d330-4ab2-beb3-7fde112a22ae/17265584552.pdf
- https://uploads.strikinglycdn.com/files/e0ea7c1e-bbb7-4158-9777-086523140aaa/98408455102.pdf
- https://uploads.strikinglycdn.com/files/4c20a355-26a8-4cfc-875f-624f37c36412/fububop.pdf
- https://uploads.strikinglycdn.com/files/7f1e30c1-0185-4848-94b7-5776a2751c6f/hi_bird_250cc_chopper.pdf
- https://uploads.strikinglycdn.com/files/522bb34c-19be-4fb5-9ab4-6e3fc933b6b8/xezepazogezuz.pdf
- https://cdn-cms.f-static.net/uploads/4366376/normal_5f870e88ca860.pdf
- https://cdn-cms.f-static.net/uploads/4366337/normal_5f873443d3778.pdf
- https://cdn-cms.f-static.net/uploads/4379961/normal_5f8b749474402.pdf
- https://cdn-cms.f-static.net/uploads/4369926/normal_5f89e94befbb1.pdf
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report