SUSPICIOUS — .pdf
SUSPICIOUS — .pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
ea72137bdc72e9514912bf4045b7be3949f3bab319addc5413978c92d59266c8 - SHA-1:
c619f981960641e0c0eebfae06c0881f8876cdac - MD5:
e36ad24d7e103d095df3414ea2ae5ff3 - ssdeep:
1536:+GFXcTQb/C4fvELHZ4JsWoY5nXkMjCh6WoQEBSF0nrCB7:nFMTQbtvugZnXB+hakwU - TLSH:
T11E38B0F310A7EC4C7ACE9F53EAEE2495208ADB895166965044CC7B6CD07CABD3E01B44 - Submitted as: .pdf
- File type: pdf · Size: 80743 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=%25D9%2583%25D9%258A%25D9%2581+%25D8%25AA%25D8%25B5%25D8%25A8%25D8%25AD+%25D8%25A7%25D9%2585%25D8%25B1%25D8%25A3%25D8%25A9+%25D9%2584%25D8%25A7+%25D8%25AA%25D9%2582%25D8%25A7%25D9%2588%25D9%2585, https://bezebaterizijir.weebly.com/uploads/1/3/1/3/131384714/be9d9f968ff.pdf, https://siregudak.weebly.com/uploads/1/3/0/7/130738759/sowemibojev_nemavi_reguxumegen_towefek.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/strik?keyword=%25D9%2583%25D9%258A%25D9%2581+%25D8%25AA%25D8%25B5%25D8%25A8%25D8%25AD+%25D8%25A7%25D9%2585%25D8%25B1%25D8%25A3%25D8%25A9+%25D9%2584%25D8%25A7+%25D8%25AA%25D9%2582%25D8%25A7%25D9%2588%25D9%2585
- https://bezebaterizijir.weebly.com/uploads/1/3/1/3/131384714/be9d9f968ff.pdf
- https://siregudak.weebly.com/uploads/1/3/0/7/130738759/sowemibojev_nemavi_reguxumegen_towefek.pdf
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/vaxukekiwurefebe.pdf
- https://nudojafobedem.weebly.com/uploads/1/3/1/3/131379550/1e853a82f77fdb.pdf
- https://zoveponezewuda.weebly.com/uploads/1/3/0/7/130738822/c76c3672.pdf
- https://s3.amazonaws.com/leguvefu/amar_chitra_katha_comics_free_download.pdf
- https://s3.amazonaws.com/zuxadol/71595929210.pdf
- https://s3.amazonaws.com/paxivogedewilu/behavioral_theory_of_personality.pdf
- https://s3.amazonaws.com/kavitokolezub/31941427906.pdf
- https://cdn-cms.f-static.net/uploads/4365619/normal_5f88b58b5ccae.pdf
- https://cdn-cms.f-static.net/uploads/4367312/normal_5f8873581df49.pdf
- https://cdn-cms.f-static.net/uploads/4389352/normal_5f8db00c2ff88.pdf
- https://cdn-cms.f-static.net/uploads/4401518/normal_5f911c12929fc.pdf
- https://uploads.strikinglycdn.com/files/d964859c-4526-4720-b6a4-d56a07056897/67527985417.pdf
- https://uploads.strikinglycdn.com/files/e6f69771-056b-4ae2-a610-5b513e30b36b/pathfinder_reach_feats.pdf
- https://uploads.strikinglycdn.com/files/157e52a4-e414-43a0-bd75-ca3a489577ed/56862643378.pdf
- https://cdn.shopify.com/s/files/1/0266/8996/2167/files/zuvolawugogusosuxoxiv.pdf
- https://cdn.shopify.com/s/files/1/0478/2758/3135/files/bowisepixurewabekes.pdf
- https://cdn.shopify.com/s/files/1/0478/2581/3663/files/12181897370.pdf
- https://cdn.shopify.com/s/files/1/0501/6423/6481/files/pewumorurowavikilinuzu.pdf
- https://cdn.shopify.com/s/files/1/0429/1713/4499/files/fiwunemer.pdf
- https://s3.amazonaws.com/felasorarabipis/dizetike.pdf
- https://s3.amazonaws.com/pazifetanegapu/professional_assembly_language.pdf
- https://s3.amazonaws.com/jamokaroxoj/noviminorufasabidupu.pdf
Embedded domains
- gettraff.ru
- bezebaterizijir.weebly.com
- siregudak.weebly.com
- keniwuki.weebly.com
- nudojafobedem.weebly.com
- zoveponezewuda.weebly.com
- s3.amazonaws.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report