SUSPICIOUS — 7923452.pdf
SUSPICIOUS — 7923452.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
f9bd82dda5db2fc60a3f0f9b3126465e62bafe66fa927f191fb549e58f962673 - SHA-1:
1ab988633c0d95dec45404ccdfab20b9de71a413 - MD5:
eb2247d5db5a34b63ff51171c4366c11 - ssdeep:
768:sgGzpDU/UlyZBP9XY8tqIcD/Q7amcP5sTuPb8KBysASbCJQq6+sg1BgRVzJfr1gJ:pGFQ/UsFXPzsJCJQ6YRVph7Ter/p - TLSH:
T186339EF350A7ED4C3ACA6F276DB71169618DD788603387A00888776CC4BC2FE6E51616 - Submitted as: 7923452.pdf
- File type: pdf · Size: 48054 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=cowbellpedia%20questions%20and%20answers%20pdf, https://cdn-cms.f-static.net/uploads/4381551/normal_5f91baed6813e.pdf, https://cdn-cms.f-static.net/uploads/4383137/normal_5f91ad830ff62.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=cowbellpedia%20questions%20and%20answers%20pdf
- https://cdn-cms.f-static.net/uploads/4381551/normal_5f91baed6813e.pdf
- https://cdn-cms.f-static.net/uploads/4383137/normal_5f91ad830ff62.pdf
- https://cdn-cms.f-static.net/uploads/4367275/normal_5f8aa826bd758.pdf
- https://cdn-cms.f-static.net/uploads/4370063/normal_5f8e36448fcb9.pdf
- https://cdn-cms.f-static.net/uploads/4377128/normal_5f8f2f6b00c85.pdf
- https://cdn-cms.f-static.net/uploads/4407318/normal_5f9268c0c5cc3.pdf
- https://cdn-cms.f-static.net/uploads/4368952/normal_5f878cbb531bc.pdf
- https://cdn-cms.f-static.net/uploads/4366346/normal_5f8cad8bcc3d3.pdf
- https://cdn-cms.f-static.net/uploads/4370555/normal_5f8847269a23c.pdf
- https://uploads.strikinglycdn.com/files/dc92fb06-56d0-424b-8687-8e0ac4aed263/tilexife.pdf
- https://uploads.strikinglycdn.com/files/bce69d93-8c67-4877-850a-faf894450e12/bare_necessities_trombone_sheet_musi.pdf
- https://cdn-cms.f-static.net/uploads/4383149/normal_5f900ac60acdf.pdf
- https://cdn-cms.f-static.net/uploads/4374839/normal_5f913d0abe46a.pdf
- https://cdn-cms.f-static.net/uploads/4371020/normal_5f8f2f50d5cba.pdf
- https://cdn-cms.f-static.net/uploads/4370791/normal_5f8e2a8aeeeea.pdf
- https://cdn-cms.f-static.net/uploads/4366020/normal_5f86fa356f75b.pdf
- https://s3.amazonaws.com/vogubivajavofu/27625240435.pdf
- https://s3.amazonaws.com/pazifetanegapu/petexuk.pdf
- https://s3.amazonaws.com/kavitokolezub/autotable_jspdf_html.pdf
- https://cdn-cms.f-static.net/uploads/4366306/normal_5f89ea2e2adc4.pdf
- https://cdn-cms.f-static.net/uploads/4374372/normal_5f8dc1e0c0408.pdf
- https://cdn-cms.f-static.net/uploads/4379233/normal_5f91310765cd6.pdf
- https://cdn-cms.f-static.net/uploads/4368245/normal_5f8c5ea2eca40.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report