SUSPICIOUS — f1f3b269b998cb4.pdf
SUSPICIOUS — f1f3b269b998cb4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 2 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
ffad971ffa3b8e7a6bc5db8eef31c696dc6777bc39b457f7dc25b559a8e1bd68 - SHA-1:
886dbff1c4337364baf09521837ed9c696912494 - MD5:
669a032b002d5aaa8ff1bc3fbbb9d907 - ssdeep:
768:ygGzpDdpC2a9UW+ZjgN9hLNtfuLeh9O28qsvYxkERB3hHec/PIR3PkZvfxoMw1lc:vGFRpC2aGbQ/HQy9vIJ8vs1PWa1kT - TLSH:
T1E234ADF350ABED0C6A876B139CEA11A90049D74D61279B900ACC377ED5BC5FE7E409A0 - Submitted as: f1f3b269b998cb4.pdf
- File type: pdf · Size: 52543 bytes
- Verdict: suspicious (58/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/c7f85dbe-588e-4f21-973c-dcddc6c7e35c/74402564514.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=puzzle%20ppt%20template%20free, https://uploads.strikinglycdn.com/files/c7f85dbe-588e-4f21-973c-dcddc6c7e35c/74402564514.pdf, https://uploads.strikinglycdn.com/files/d89b4642-a39d-4b42-a8a8-45347785d46f/paduziraluzavijijelil.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=puzzle%20ppt%20template%20free
- https://uploads.strikinglycdn.com/files/c7f85dbe-588e-4f21-973c-dcddc6c7e35c/74402564514.pdf
- https://uploads.strikinglycdn.com/files/d89b4642-a39d-4b42-a8a8-45347785d46f/paduziraluzavijijelil.pdf
- https://uploads.strikinglycdn.com/files/19d84c94-1ead-4d8e-ae27-16d158b5cf34/7130105076.pdf
- https://uploads.strikinglycdn.com/files/6e911281-b15b-4ce5-a66d-1e332c3d0f3e/vunaki.pdf
- https://uploads.strikinglycdn.com/files/9d9c6148-84df-4374-b6a4-56dfdc7bffae/belufofezawexozubibotot.pdf
- https://uploads.strikinglycdn.com/files/3ac81e09-3dab-4f9d-ba6f-303be4898afa/vuvoxetalapo.pdf
- https://cdn.shopify.com/s/files/1/0266/9697/4508/files/century_21_accounting_9e_answer_key.pdf
- https://cdn.shopify.com/s/files/1/0438/1750/0834/files/sufepezulipowuzowule.pdf
- https://cdn.shopify.com/s/files/1/0429/2722/7036/files/small_country_towns_in_south_carolina.pdf
- https://cdn.shopify.com/s/files/1/0437/5507/7781/files/kepafuniloxipoxaj.pdf
- https://cdn-cms.f-static.net/uploads/4367919/normal_5f87b1b08de1a.pdf
- https://cdn-cms.f-static.net/uploads/4366357/normal_5f879a60e1e07.pdf
- https://site-1042940.mozfiles.com/files/1042940/kamik.pdf
- https://site-1039503.mozfiles.com/files/1039503/jupyter_notebook_convert_to_without_code.pdf
- https://site-1043853.mozfiles.com/files/1043853/72535960876.pdf
- https://site-1043790.mozfiles.com/files/1043790/52272881351.pdf
- https://site-1037091.mozfiles.com/files/1037091/69492481584.pdf
- https://cdn-cms.f-static.net/uploads/4366022/normal_5f86fe716c99c.pdf
- https://cdn-cms.f-static.net/uploads/4366306/normal_5f879eedae195.pdf
- https://cdn-cms.f-static.net/uploads/4366040/normal_5f86f94339fdb.pdf
- https://cdn-cms.f-static.net/uploads/4366973/normal_5f87ab3566861.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- cdn-cms.f-static.net
- site-1042940.mozfiles.com
- site-1039503.mozfiles.com
- site-1043853.mozfiles.com
- site-1043790.mozfiles.com
- site-1037091.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report