SUSPICIOUS — 5590226.pdf
SUSPICIOUS — 5590226.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
fea01d680cb687be86473f6e06a675335f92d6f0efc0281d39b945c4b7a9b5df - SHA-1:
2f126b14beb6faefbf4accf6b54491cb52d6cff2 - MD5:
f1d81076f12c5952199d5550cab63c3d - ssdeep:
768:igGzpDvpURktQT9Kuy/tDJY74Z1kXWFv0O1REJI/n1js1+3IGiGGFGWm:/GFrpTbocZDFv0OsMnNsKIGiGGFGWm - TLSH:
T140328DF310A7DD4C794F6B039EBB116D908AD68D61369B90448C226CD47CAED7E00A76 - Submitted as: 5590226.pdf
- File type: pdf · Size: 45326 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=framemaker%20xml%20tutorial, https://cdn.shopify.com/s/files/1/0486/4068/8296/files/61824849310.pdf, https://cdn.shopify.com/s/files/1/0437/2643/8550/files/words_that_start_with_the_letter_d_that_describe_a_person.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=framemaker%20xml%20tutorial
- https://cdn.shopify.com/s/files/1/0486/4068/8296/files/61824849310.pdf
- https://cdn.shopify.com/s/files/1/0437/2643/8550/files/words_that_start_with_the_letter_d_that_describe_a_person.pdf
- https://cdn.shopify.com/s/files/1/0496/1307/8681/files/74029598289.pdf
- https://uploads.strikinglycdn.com/files/e563c3dc-0ad1-4884-82df-dd401191c0f9/10318558339.pdf
- https://uploads.strikinglycdn.com/files/9d9845a5-4034-43c3-88de-06aee08d68f4/35966313440.pdf
- https://uploads.strikinglycdn.com/files/611ff927-62d2-42a6-a72c-b7308e075dc5/38504614409.pdf
- https://uploads.strikinglycdn.com/files/29eeaea0-3fda-4b02-be52-fa9afc63d0fc/48037598662.pdf
- https://uploads.strikinglycdn.com/files/cb42e076-b974-47eb-ad1a-458e15f41402/mexezawopisozi.pdf
- https://site-1044306.mozfiles.com/files/1044306/quadrilateral_types_and_properties.pdf
- https://site-1039869.mozfiles.com/files/1039869/53980763814.pdf
- https://sepenunaxob.weebly.com/uploads/1/3/0/7/130776074/9428907.pdf
- https://babikovinemixe.weebly.com/uploads/1/3/1/8/131856339/706a53901fae66.pdf
- https://zeginuvo.weebly.com/uploads/1/3/0/7/130775519/3149094fed.pdf
- https://medizagokitoni.weebly.com/uploads/1/3/2/3/132303310/vubegirudatetigujevu.pdf
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/bewomo.pdf
- https://cdn-cms.f-static.net/uploads/4366335/normal_5f88c639c4fc5.pdf
- https://cdn-cms.f-static.net/uploads/4367646/normal_5f88bcf2e8dda.pdf
- https://cdn-cms.f-static.net/uploads/4365547/normal_5f8713613ece3.pdf
- https://cdn-cms.f-static.net/uploads/4368245/normal_5f88b5ec73da0.pdf
- https://site-1039837.mozfiles.com/files/1039837/lilitonekijaturer.pdf
- https://site-1044071.mozfiles.com/files/1044071/faxunegamonopopufinireti.pdf
- https://site-1039000.mozfiles.com/files/1039000/96483907077.pdf
- https://site-1037187.mozfiles.com/files/1037187/65414033797.pdf
- https://site-1043295.mozfiles.com/files/1043295/44018254621.pdf
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- site-1044306.mozfiles.com
- site-1039869.mozfiles.com
- sepenunaxob.weebly.com
- babikovinemixe.weebly.com
- zeginuvo.weebly.com
- medizagokitoni.weebly.com
- bedizegoresupa.weebly.com
- cdn-cms.f-static.net
- site-1039837.mozfiles.com
- site-1044071.mozfiles.com
- site-1039000.mozfiles.com
- site-1037187.mozfiles.com
- site-1043295.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report