SUSPICIOUS — 1667499.pdf
SUSPICIOUS — 1667499.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
fa0b5bee950a472c6fb18f591d9015d74864c4d8a36325058df7b34409a71107 - SHA-1:
72dc7c60c6ceb1198f87b5eb0120dac15490e205 - MD5:
5ce8679b63c7d28b2c8338f24e07dfe1 - ssdeep:
768:NgGzpDoe8bSbfBBFhcgjH9N/jUZavGg6sOA3bkojcCu0qOTyYp7E:uGFUeJ3i+GRVA3Nlu1O9p7E - TLSH:
T1DF328EF30097ED8C7BCB9B13ADAA1199518AC7486133DBA445CC772CC4BC2ACBE51960 - Submitted as: 1667499.pdf
- File type: pdf · Size: 45448 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=aplus.%20net%20email%20settings, https://uploads.strikinglycdn.com/files/39482d1a-ffe9-42d6-ab11-aba289cf9a7d/disiloginezozizinopude.pdf, https://uploads.strikinglycdn.com/files/aad88d29-e7cb-49b3-8f2f-64dacb9291fc/tuxotumemudibokapilaxu.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=aplus.%20net%20email%20settings
- https://uploads.strikinglycdn.com/files/39482d1a-ffe9-42d6-ab11-aba289cf9a7d/disiloginezozizinopude.pdf
- https://uploads.strikinglycdn.com/files/aad88d29-e7cb-49b3-8f2f-64dacb9291fc/tuxotumemudibokapilaxu.pdf
- https://uploads.strikinglycdn.com/files/39355e0d-a049-44ba-9860-e9e7a19c94f5/zusederupalaligepikifolu.pdf
- https://cdn-cms.f-static.net/uploads/4366987/normal_5f877279b0108.pdf
- https://cdn-cms.f-static.net/uploads/4365580/normal_5f875b29650f4.pdf
- https://cdn-cms.f-static.net/uploads/4366653/normal_5f874af0ca2ab.pdf
- https://cdn.shopify.com/s/files/1/0493/9966/0711/files/difference_between_atoms_and_molecules_in_hindi.pdf
- https://cdn.shopify.com/s/files/1/0435/2960/1175/files/99113374495.pdf
- https://cdn.shopify.com/s/files/1/0483/3227/5865/files/walemadif.pdf
- https://cdn.shopify.com/s/files/1/0438/0894/8386/files/81058433983.pdf
- https://site-1039162.mozfiles.com/files/1039162/tebepisumetizunosotada.pdf
- https://site-1039161.mozfiles.com/files/1039161/jarilupafifipapinem.pdf
- https://cdn-cms.f-static.net/uploads/4365655/normal_5f8722de5af8b.pdf
- https://cdn-cms.f-static.net/uploads/4366647/normal_5f8771ed57294.pdf
- https://cdn-cms.f-static.net/uploads/4366327/normal_5f870e34e1265.pdf
- https://cdn-cms.f-static.net/uploads/4367632/normal_5f87772d4c52d.pdf
- https://boguvetasitob.weebly.com/uploads/1/3/1/3/131380850/88bd66a85400a.pdf
- https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/7805117.pdf
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/bf4458.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/0c18874847f.pdf
- https://fekudumubaf.weebly.com/uploads/1/3/2/6/132681201/d54f4d96cedca1.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- cdn.shopify.com
- site-1039162.mozfiles.com
- site-1039161.mozfiles.com
- boguvetasitob.weebly.com
- mogilifus.weebly.com
- keniwuki.weebly.com
- dutitujazekap.weebly.com
- fekudumubaf.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report