SUSPICIOUS — 9461a.pdf
SUSPICIOUS — 9461a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
f48a0597ec3712481941ce93e0a44dbab42f45f7311cd5a9520a6f0b82465b37 - SHA-1:
2f6a5cfe39a8820b0b03dd6458b83d0b25304a0a - MD5:
d434c0fcef9d6e7911c45304b77b62e5 - ssdeep:
768:4SIgGzpDepf6otIcXRna1WSnL9Tz/rASg9/cVR0pPnsH7vf+JQG4A5aup0buKK0a:jGFapoA0VREsH73+Vuup0KKpxlMjC/Y - TLSH:
T18B329EF310A7ED4D7A8B6F535DAA10AA5449D7886136CB5058CCBB2CC5BC5BEBF00860 - Submitted as: 9461a.pdf
- File type: pdf · Size: 45655 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=el%20sindrome%20de%20ulises%20psicologia, https://cdn.shopify.com/s/files/1/0482/3361/1418/files/93102740197.pdf, https://cdn.shopify.com/s/files/1/0439/4916/2654/files/boxojokemopij.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=el%20sindrome%20de%20ulises%20psicologia
- https://cdn.shopify.com/s/files/1/0482/3361/1418/files/93102740197.pdf
- https://cdn.shopify.com/s/files/1/0439/4916/2654/files/boxojokemopij.pdf
- https://cdn.shopify.com/s/files/1/0479/4649/8204/files/dan_marino_rookie_card_psa.pdf
- https://cdn.shopify.com/s/files/1/0432/5294/0968/files/soxil.pdf
- https://cdn.shopify.com/s/files/1/0439/2094/9403/files/92196996925.pdf
- https://cdn.shopify.com/s/files/1/0438/0943/9906/files/ky_court_net_2.0.pdf
- https://cdn.shopify.com/s/files/1/0486/1411/3445/files/we_go_for_the_gold.pdf
- https://cdn.shopify.com/s/files/1/0434/2746/3324/files/30890250258.pdf
- https://cdn.shopify.com/s/files/1/0427/3651/7286/files/titafupukowovafe.pdf
- https://duxixujojive.weebly.com/uploads/1/3/0/7/130739103/defanopowokev_kogopaxikawu.pdf
- https://lajojixuvoporor.weebly.com/uploads/1/3/0/7/130738555/2898707.pdf
- https://lipowuripipu.weebly.com/uploads/1/3/1/3/131378852/3e98b5.pdf
- https://pojutawetuje.weebly.com/uploads/1/3/1/3/131382470/wezunuvexage.pdf
- https://soxajenukaru.weebly.com/uploads/1/3/0/8/130874283/50cbff319db9.pdf
- https://tivakoxidedopa.weebly.com/uploads/1/3/0/7/130776298/a93e1b5c04.pdf
- https://cdn-cms.f-static.net/uploads/4374708/normal_5f8912363b661.pdf
- https://cdn-cms.f-static.net/uploads/4374519/normal_5f8b3dadd4937.pdf
- https://cdn-cms.f-static.net/uploads/4366343/normal_5f873cb8c4398.pdf
- https://cdn-cms.f-static.net/uploads/4379851/normal_5f8b5b728e793.pdf
- https://cdn-cms.f-static.net/uploads/4368788/normal_5f8b688f930d7.pdf
- https://cdn-cms.f-static.net/uploads/4368501/normal_5f8b80c1bec8b.pdf
- https://cdn-cms.f-static.net/uploads/4366044/normal_5f8b507b4d3c5.pdf
- https://cdn-cms.f-static.net/uploads/4380705/normal_5f8b55d198f5e.pdf
- https://cdn-cms.f-static.net/uploads/4366032/normal_5f8778a85cdfa.pdf
Embedded domains
- cctraff.ru
- cdn.shopify.com
- duxixujojive.weebly.com
- lajojixuvoporor.weebly.com
- lipowuripipu.weebly.com
- pojutawetuje.weebly.com
- soxajenukaru.weebly.com
- tivakoxidedopa.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report