SUSPICIOUS — 6f5e95ccc1.pdf
SUSPICIOUS — 6f5e95ccc1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f6741fc45b90bb3bd688218cd5d2fb14a77b2fdb01866858d31ef9307a3ea2fb - SHA-1:
4f15dc2291db9a2ba1704503c987efe0c3cf36af - MD5:
0e80586c620e26f9f3d41a830443d5ab - ssdeep:
768:ZgGzpD+epUlaT2+x5rBGYjRJy1f9rIH2XWC+iBc+2h62r2pM4a8hP2K/fv3KRjVQ:aGFaepA22EXymEBF2o2rSa8hP2K/3K5C - TLSH:
T19D337EF350A7ED8C3B8BDF03A9F6201D614AEA485132AA90858C772CC5BC77D7E50A51 - Submitted as: 6f5e95ccc1.pdf
- File type: pdf · Size: 48079 bytes
- Verdict: suspicious (58/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/9f1c8e9b-4bab-4432-8e27-bd74512fa930/pujuzunomes.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=escala%20de%20glasgow%20slideshare, https://cdn.shopify.com/s/files/1/0428/3754/1031/files/unblocked_games_77_weebly.pdf, https://cdn.shopify.com/s/files/1/0430/0003/7527/files/final_fantasy_7_original_pc_download.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=escala%20de%20glasgow%20slideshare
- https://cdn.shopify.com/s/files/1/0428/3754/1031/files/unblocked_games_77_weebly.pdf
- https://cdn.shopify.com/s/files/1/0430/0003/7527/files/final_fantasy_7_original_pc_download.pdf
- https://cdn.shopify.com/s/files/1/0433/7241/3079/files/epic_of_gilgamesh_sparknotes_summary.pdf
- https://cdn.shopify.com/s/files/1/0440/1030/7749/files/mortal_kombat_armageddon_chameleon.pdf
- https://cdn.shopify.com/s/files/1/0428/0179/1132/files/majiriramexi.pdf
- https://uploads.strikinglycdn.com/files/5cfe7362-3411-483a-b8dd-8f14d618e749/lifivu.pdf
- https://uploads.strikinglycdn.com/files/9f1c8e9b-4bab-4432-8e27-bd74512fa930/pujuzunomes.pdf
- https://uploads.strikinglycdn.com/files/9afb0b8e-17bf-4fb5-89c7-d70fa47b7375/69859890000.pdf
- https://cdn.shopify.com/s/files/1/0496/6049/3981/files/warriors_of_the_storm_brida_death.pdf
- https://cdn.shopify.com/s/files/1/0500/2179/3942/files/wow_classic_shaman_leveling.pdf
- https://cdn.shopify.com/s/files/1/0500/4079/9392/files/wupope.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/winepogor.pdf
- https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/wovexofek.pdf
- https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/kezedivalo-bolumukejufufik.pdf
- https://rolosakuzorega.weebly.com/uploads/1/3/1/3/131379035/wotigi.pdf
- https://kasukironumasex.weebly.com/uploads/1/3/1/4/131454791/2173021.pdf
- https://uploads.strikinglycdn.com/files/a17336f8-c9ee-46d4-9422-e1ae3d40cead/48323037117.pdf
- https://uploads.strikinglycdn.com/files/939383c4-3cb8-4f1b-ae51-c0fce6c1ef01/58475646711.pdf
- https://uploads.strikinglycdn.com/files/e7a0dce4-6173-4dcb-b436-1d3919ce0ba3/45411617357.pdf
- https://cdn.shopify.com/s/files/1/0266/8675/0916/files/nike_international_marketing_strategy.pdf
- https://cdn.shopify.com/s/files/1/0482/6133/3147/files/cubs_for_sale.pdf
- https://cdn.shopify.com/s/files/1/0460/7721/4884/files/jerry_falwell_listen_america_1980.pdf
- https://cdn.shopify.com/s/files/1/0436/2056/5156/files/paw_patrol_car.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- gettraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- zoxuzuxebexot.weebly.com
- jawasolasazilem.weebly.com
- dimaxafazeza.weebly.com
- rolosakuzorega.weebly.com
- kasukironumasex.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report