SUSPICIOUS — 49578587285.pdf

SUSPICIOUS — 49578587285.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 191f33ca07948bf20c5ed99eaf7969993b0968fe68015e959d969c668c303db9
• SHA-1: 5c8405145b1a0b73184bf9b5af4cdacdc5afdb09
• MD5: 408cca87a55d116401660803ac91c72f
• ssdeep: 768:NgGzpDHXVjFn6BnP/mNr4xxJnPL8IjTxj4ABp1w1gsUXRDZikfLgi0p+PFw:uGFL4vnY6tccrs0RDj38GFw
• TLSH: T10B319EF390A3DC8C5987AF07ADDA249E9185E6886132E774459D772DC4BC3BC7E00921
• Submitted as: 49578587285.pdf
• File type: pdf · Size: 41894 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=header%2528+content-type+application%252Fpdf+charset%253Dutf-8+%2529, https://cdn.shopify.com/s/files/1/0430/4027/6642/files/17588034187.pdf, https://cdn.shopify.com/s/files/1/0483/9614/0712/files/the_handmaids_tale_ebook_deutsch.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=header%2528+content-type+application%252Fpdf+charset%253Dutf-8+%2529
• https://cdn.shopify.com/s/files/1/0430/4027/6642/files/17588034187.pdf
• https://cdn.shopify.com/s/files/1/0483/9614/0712/files/the_handmaids_tale_ebook_deutsch.pdf
• https://cdn.shopify.com/s/files/1/0479/3273/5655/files/dabalitozoxopur.pdf
• https://cdn.shopify.com/s/files/1/0434/9827/4978/files/proform_crosswalk_325x_manual.pdf
• https://cdn.shopify.com/s/files/1/0481/7610/3591/files/28654285615.pdf
• https://site-1038413.mozfiles.com/files/1038413/dojurajujirepu.pdf
• https://site-1036839.mozfiles.com/files/1036839/wadolimikeduxupobijorawo.pdf
• https://cdn.shopify.com/s/files/1/0496/6203/4069/files/pexuseval.pdf
• https://cdn.shopify.com/s/files/1/0485/9533/7376/files/gelisukesijabewisene.pdf
• http://files.modernterrain.com/uploads/1/3/1/6/131606133/7127378.pdf
• http://files.paintingbyme.com/uploads/1/3/0/7/130739919/84e7056687e.pdf
• http://bupadof.softcinch.com/uploads/1/3/1/3/131380504/dd7776096a0e34b.pdf
• http://files.lucialightexperience.com/uploads/1/3/1/4/131438389/ebb06ad9fc1a5.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• cdn.shopify.com
• site-1038413.mozfiles.com
• site-1036839.mozfiles.com
• files.modernterrain.com
• files.paintingbyme.com
• bupadof.softcinch.com
• files.lucialightexperience.com
• h5.eu
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report