SUSPICIOUS — 40258038308.pdf

SUSPICIOUS — 40258038308.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 1c0fdf8e452263072ff99598a850787e46119aa9266df6e8ca9e69493fea15f7
• SHA-1: 205cfef0f02e078432c4ce4cc9a26a1a75e45a6b
• MD5: a13f47823b6fac8c67a9ad3c19095b88
• ssdeep: 1536:tGFxeqgK1RqusyyhdcyyDxP/7uIw1NXT:wFxeqgg4uyyD9juI8ND
• TLSH: T1A033AFF3109BED8C7ACA6B03AEAA10596106C34C2133A6B11ADC777CC4BC6FD6E51651
• Submitted as: 40258038308.pdf
• File type: pdf · Size: 50221 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=skyrim+locate+grimsever+walkthrough, https://cdn.shopify.com/s/files/1/0439/3716/9576/files/xufujanu.pdf, https://cdn.shopify.com/s/files/1/0431/0876/1751/files/sakabemojalivija.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/strik?keyword=skyrim+locate+grimsever+walkthrough
• https://cdn.shopify.com/s/files/1/0439/3716/9576/files/xufujanu.pdf
• https://cdn.shopify.com/s/files/1/0431/0876/1751/files/sakabemojalivija.pdf
• https://cdn.shopify.com/s/files/1/0429/2929/1427/files/peskin_particle_physics.pdf
• https://cdn.shopify.com/s/files/1/0479/6629/0076/files/stephen_marley_mind_control_zip_download.pdf
• http://xeworupi.centerforpassionaterelationships.com/uploads/1/3/1/1/131164278/9444733.pdf
• http://files.suprepaga.com/uploads/1/3/0/7/130740001/fitelabaz.pdf
• https://uploads.strikinglycdn.com/files/d40f4762-4f38-445b-bd18-519e90f7c753/zasijufedokunudilafebemon.pdf
• https://uploads.strikinglycdn.com/files/45c4f196-3091-466c-8ba9-a1c2cfdf459a/gizetadexuzazatobifa.pdf
• https://uploads.strikinglycdn.com/files/e0788b72-46f9-43c4-8835-1c3f72ae6d40/99570908027.pdf
• https://uploads.strikinglycdn.com/files/8b6bfb59-6a20-4db9-a969-9de9cba7da18/80395879094.pdf
• http://files.lisadenham.com/uploads/1/3/1/3/131379434/sikusawadulime.pdf
• http://files.bdwteachers.com/uploads/1/3/1/0/131069934/7607716.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• cdn.shopify.com
• xeworupi.centerforpassionaterelationships.com
• files.suprepaga.com
• uploads.strikinglycdn.com
• files.lisadenham.com
• files.bdwteachers.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report