SUSPICIOUS — 1749985.pdf
SUSPICIOUS — 1749985.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
ed99fd752a73f85f2a3f2e1c77f3fd70409c65d01dfd0b0bf3f58695687f5935 - SHA-1:
8a24165d87160d7094274627c3414f56262c3b97 - MD5:
8093b435d5d5610a80a3cd4784c5885f - ssdeep:
768:fgGzpD1fzMK+Gojya9uuSIRd/4AL12QrXTbu1SKvUioGJWooNsIx2pIBpAo:oGF5SlhxpVe1dvDBJ4s+2pOpAo - TLSH:
T14532AEF3206BDD8C7E879F576AB50248605AC7C9A177966018DA37ACC4BC2BC7F10960 - Submitted as: 1749985.pdf
- File type: pdf · Size: 46708 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=capitalismo%20e%20urbaniza%C3%A7%C3%A3o%20pdf, https://nuvisinuxaxo.weebly.com/uploads/1/3/1/3/131383681/01a180f093ecc.pdf, https://cdn-cms.f-static.net/uploads/4368506/normal_5f94d50772f01.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=capitalismo%20e%20urbaniza%C3%A7%C3%A3o%20pdf
- https://nuvisinuxaxo.weebly.com/uploads/1/3/1/3/131383681/01a180f093ecc.pdf
- https://cdn-cms.f-static.net/uploads/4368506/normal_5f94d50772f01.pdf
- https://s3.amazonaws.com/xakapudakadu/lozujudemewazikebe.pdf
- https://cdn-cms.f-static.net/uploads/4386613/normal_5f8c8bbb40a0d.pdf
- https://cdn-cms.f-static.net/uploads/4375716/normal_5f9291e517008.pdf
- https://cdn-cms.f-static.net/uploads/4383791/normal_5f988443a0938.pdf
- https://cdn.shopify.com/s/files/1/0500/3876/7787/files/conductismo_y_sus_autores.pdf
- https://cdn.shopify.com/s/files/1/0429/5933/9673/files/frayer_model_template_2_per_page.pdf
- https://s3.amazonaws.com/gupuso/maternity_leave_format.pdf
- https://s3.amazonaws.com/lewuli/website_redesign_proposal.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- cctraff.ru
- nuvisinuxaxo.weebly.com
- cdn-cms.f-static.net
- s3.amazonaws.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report