SUSPICIOUS — 24488074740.pdf

SUSPICIOUS — 24488074740.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 20a71a527654b3a39ab38a0dc9e6b694cd679c85a3dbe41e3a397954639a5d54
• SHA-1: 19c69a2b1e5d57e5446f8a97f94ae51657f86307
• MD5: a1f38ee0fbaf96ac67c101ceb0fbadf8
• ssdeep: 768:SgGzpDx7N84Ttj7ibbM7nH1lECeXD4LWzhO3ByozYt8:PGFN7rnHTtK4LWNeyozYt8
• TLSH: T155309FF31167EC8C76866B03AED61119A14AC78C6032DAB445CC3B6CD47C9FDBE50A61
• Submitted as: 24488074740.pdf
• File type: pdf · Size: 37046 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=buffalo+the+name+dropping+game+pdf, https://cdn.shopify.com/s/files/1/0480/6993/5267/files/77862486791.pdf, https://cdn.shopify.com/s/files/1/0434/7481/3090/files/iced_coffee_maker_mr_coffee.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=buffalo+the+name+dropping+game+pdf
• https://cdn.shopify.com/s/files/1/0480/6993/5267/files/77862486791.pdf
• https://cdn.shopify.com/s/files/1/0434/7481/3090/files/iced_coffee_maker_mr_coffee.pdf
• https://cdn.shopify.com/s/files/1/0440/5949/2517/files/buwoneniver.pdf
• https://site-1037184.mozfiles.com/files/1037184/93192276379.pdf
• https://site-1037868.mozfiles.com/files/1037868/zidegi.pdf
• https://site-1037240.mozfiles.com/files/1037240/66446496552.pdf
• https://cdn.shopify.com/s/files/1/0481/6587/9957/files/strike_the_blood_manga_wiki.pdf
• https://cdn.shopify.com/s/files/1/0484/4722/6024/files/hufflepuff_common_room_password.pdf
• https://cdn.shopify.com/s/files/1/0438/5567/5552/files/the_cask_of_amontillado_character_montresor.pdf
• https://cdn.shopify.com/s/files/1/0476/5460/0870/files/vuluraguvefufemowum.pdf
• https://cdn.shopify.com/s/files/1/0483/4190/9653/files/balloons_and_static_electricity_answer_key.pdf
• https://cdn.shopify.com/s/files/1/0481/5136/3735/files/student_manual_old_testament_lds.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• cdn.shopify.com
• site-1037184.mozfiles.com
• site-1037868.mozfiles.com
• site-1037240.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report