SUSPICIOUS — d35a684dd.pdf

SUSPICIOUS — d35a684dd.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: fe6e58822d2a9d0b1751c97cd321cd05e78b09e5f547402156ef98f8e7b66bb2
• SHA-1: 3c39a7d0a34b677867c6ddf73d14b56e413e8c75
• MD5: fb95eddc024cd2c949ff5a083b9935e6
• ssdeep: 768:5gGzpDuophRLCl9gj/rYzLzV2VmM9qLNvZ+vmZd2Mvm/Jn8:6GFiofRtYjVAwLTuO24m/Jn8
• TLSH: T1E432BFF310A3DD887B86DB035EE6245D614AC78C71724A6009D87A7CC8BC8FD6E64DA0
• Submitted as: d35a684dd.pdf
• File type: pdf · Size: 44270 bytes
• Verdict: suspicious (44/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://trafffe.ru/wb?keyword=lego%20batman%20apk%20download, https://gadigode.weebly.com/uploads/1/3/2/6/132680949/woreretifufakevaxor.pdf, https://buveziketi.weebly.com/uploads/1/3/1/3/131398526/vupuxa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafffe.ru/wb?keyword=lego%20batman%20apk%20download
• https://gadigode.weebly.com/uploads/1/3/2/6/132680949/woreretifufakevaxor.pdf
• https://buveziketi.weebly.com/uploads/1/3/1/3/131398526/vupuxa.pdf
• https://lijatiwove.files.wordpress.com/2020/11/aqiyl_aniys_alkaline_herbal_medicine.pdf
• https://s3.amazonaws.com/zuses/umarex_steel_force_air_rifle.pdf
• https://s3.amazonaws.com/vezumobigodub/8086_assembly_language_programming.pdf
• https://uploads.strikinglycdn.com/files/4c338257-0df3-41d4-a810-62fa56e92a25/shadowrun_bug_city.pdf
• https://s3.amazonaws.com/zuxadol/3858688140.pdf
• https://uploads.strikinglycdn.com/files/d60d3b45-6561-4a25-b84d-0628f68a06f1/zegebuzividoka.pdf
• https://s3.amazonaws.com/sukedil/infinitely_many_solutions_sat.pdf
• https://s3.amazonaws.com/zizene/what_are_the_elements_of_theatre_composition.pdf
• https://uploads.strikinglycdn.com/files/1b4b45e5-0d08-4a74-867f-4a943a7432b3/87906543124.pdf
• https://s3.amazonaws.com/zufaxepixiguxax/edgar_allan_poe_cuervo.pdf
• https://s3.amazonaws.com/netinuwa/45901918031.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffe.ru
• gadigode.weebly.com
• buveziketi.weebly.com
• lijatiwove.files.wordpress.com
• s3.amazonaws.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report