SUSPICIOUS — 31166947734.pdf

SUSPICIOUS — 31166947734.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 13388b3edaa400c779a7ff1746aa3f3b4207f6b37a5f565f3514493a8818d7b8
• SHA-1: f60b79afbcf4f282cce78f93343ebe857c5d1e7e
• MD5: 86f613a3fd7301aac8471907ac1177f6
• ssdeep: 768:1gGzpDLl83+QHbzHp2k3TxkHnEHrM8NvIpfRqRQOf3gqsIGK4L5IQ60riE2xd6Eh:mGFvWHbzHskltrM8dERqRbdsIu5b60rS
• TLSH: T1B032AFF311A7ED8D7A86BF83AEAB01997545C28C7132969018D87A2CC4782FD3F50961
• Submitted as: 31166947734.pdf
• File type: pdf · Size: 45351 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=akateko+to+spanish, http://vudozogi.travelanswersbybrandi.com/uploads/1/3/1/3/131383581/petebabola.pdf, http://files.clairdelunerockymount.com/uploads/1/3/1/3/131379231/5524949.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/strik?keyword=akateko+to+spanish
• http://vudozogi.travelanswersbybrandi.com/uploads/1/3/1/3/131383581/petebabola.pdf
• http://files.clairdelunerockymount.com/uploads/1/3/1/3/131379231/5524949.pdf
• http://files.thepuredreamfortwayne.com/uploads/1/3/2/6/132682697/woxowawolaz.pdf
• http://files.downsizefarm.com/uploads/1/3/0/9/130970008/fexaju.pdf
• http://files.radiowapa.com/uploads/1/3/1/3/131382134/mobafuguj.pdf
• https://site-1036838.mozfiles.com/files/1036838/80410175991.pdf
• https://site-1036945.mozfiles.com/files/1036945/tanuluwaxodawigopavuj.pdf
• https://cdn.shopify.com/s/files/1/0495/1470/9160/files/armor_check_penalty.pdf
• https://cdn.shopify.com/s/files/1/0432/9000/1572/files/tamabipafudutodimone.pdf
• http://files.manuillmusic.com/uploads/1/3/1/3/131379035/jutosadik_zivefuxokife_narejawugo.pdf
• http://files.crochetmaniac.com/uploads/1/3/2/7/132740598/panowozadakogana.pdf
• http://gijuguxun.phyto5.com.au/uploads/1/3/2/3/132303382/ca8b2987dde8.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• vudozogi.travelanswersbybrandi.com
• files.clairdelunerockymount.com
• files.thepuredreamfortwayne.com
• files.downsizefarm.com
• files.radiowapa.com
• site-1036838.mozfiles.com
• site-1036945.mozfiles.com
• cdn.shopify.com
• files.manuillmusic.com
• files.crochetmaniac.com
• gijuguxun.phyto5.com.au
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report