SUSPICIOUS — 2985745640.pdf
SUSPICIOUS — 2985745640.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
14e17ce1cbefa7852b7959754d4f4bc930493c1e124cb6b4d996f60ce72250e5 - SHA-1:
f7e4e754dddad65db64977340b9254888405785b - MD5:
ee23c5ad71dc5190b8c85294154e56da - ssdeep:
768:qgGzpDefTnHkU4J0p4yIKCUL7SKpRkYVc7xmI1MflW0LbCyqC:3GFaLJFWUL7SOWYmmI1sW0nCyV - TLSH:
T18432AFF350B7FD8C7BCFAF0369A614A96095C28D51374A6044D9377DD0B86BDAE10920 - Submitted as: 2985745640.pdf
- File type: pdf · Size: 44382 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=who+moved+my+cheese+review, http://dalawaral.coverthosebases.com/uploads/1/3/1/3/131382982/ba1c39.pdf, http://files.mrallansciencegfc.com/uploads/1/3/0/7/130776418/4cbb014.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://gettraff.ru/strik?keyword=who+moved+my+cheese+review
- http://dalawaral.coverthosebases.com/uploads/1/3/1/3/131382982/ba1c39.pdf
- http://files.mrallansciencegfc.com/uploads/1/3/0/7/130776418/4cbb014.pdf
- http://feguk.gchumsoc.org/uploads/1/3/0/8/130813084/gikijol_duzasuzewobixas_tewekezivumevoz_gaxomoz.pdf
- https://site-1043562.mozfiles.com/files/1043562/bomolibatoberozolegib.pdf
- https://site-1041782.mozfiles.com/files/1041782/93835488597.pdf
- https://site-1037187.mozfiles.com/files/1037187/kolekosulazajojobivimopo.pdf
- https://site-1045364.mozfiles.com/files/1045364/74238328889.pdf
- https://site-1036991.mozfiles.com/files/1036991/xabujuxanogunekidubimemo.pdf
- http://wogim.corinnemclaughlin.com/uploads/1/3/1/1/131164572/aa179cf9cd8287.pdf
- http://puvatemo.allegraclark.com/uploads/1/3/1/8/131856293/wirin_puvikaliw_dosejori_sodedekuzepuk.pdf
- http://files.beighleighbeagles.com/uploads/1/3/1/4/131409158/fipanezotelija_xepubimidogarek_popivosaza.pdf
- http://pavuk.onsitecprtrainer.com/uploads/1/3/1/4/131406436/8534555.pdf
- http://files.worksafehsesolutions.com/uploads/1/3/0/8/130874612/a752f7792dfee.pdf
- https://site-1037903.mozfiles.com/files/1037903/pevubupejezamuji.pdf
- https://site-1043837.mozfiles.com/files/1043837/13518394785.pdf
- https://site-1039806.mozfiles.com/files/1039806/mobaduvebixoxalugapag.pdf
- https://site-1038605.mozfiles.com/files/1038605/46964787517.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- dalawaral.coverthosebases.com
- files.mrallansciencegfc.com
- feguk.gchumsoc.org
- site-1043562.mozfiles.com
- site-1041782.mozfiles.com
- site-1037187.mozfiles.com
- site-1045364.mozfiles.com
- site-1036991.mozfiles.com
- wogim.corinnemclaughlin.com
- puvatemo.allegraclark.com
- files.beighleighbeagles.com
- pavuk.onsitecprtrainer.com
- files.worksafehsesolutions.com
- site-1037903.mozfiles.com
- site-1043837.mozfiles.com
- site-1039806.mozfiles.com
- site-1038605.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report