SUSPICIOUS — 66564013372.pdf
SUSPICIOUS — 66564013372.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
228268e7aa1b2b798197591ad8bb81e9bddbef0e98b0f7c63fc6aa9773aeb017 - SHA-1:
af58cac9838fce5fb6d7c5e2a4ab9308fc2023ce - MD5:
13dec2ca1edaa4a78d09e399eb5cd318 - ssdeep:
768:JgGzpDopDB2MI1rtZXRoub9lh45NG2JbaeYlIX3O7pmzrOYPd6khj53:qGFkpD8Wu5l65g2J+eYsopMrOYPd6khB - TLSH:
T197319EF79097ED8C7D8BAB07BDA61198614AC68C3137A76059C8372CC4BC6ED2F50960 - Submitted as: 66564013372.pdf
- File type: pdf · Size: 41351 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/pify?keyword=surah+yasin+benefits, https://uploads.strikinglycdn.com/files/b427e94f-0dd3-41b6-9ee1-cf222fece631/gakemowajewikotowuji.pdf, https://uploads.strikinglycdn.com/files/ddcc1228-93f3-4577-895a-fa95df53f646/vuwusoxufididubovarone.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/pify?keyword=surah+yasin+benefits
- https://uploads.strikinglycdn.com/files/b427e94f-0dd3-41b6-9ee1-cf222fece631/gakemowajewikotowuji.pdf
- https://uploads.strikinglycdn.com/files/ddcc1228-93f3-4577-895a-fa95df53f646/vuwusoxufididubovarone.pdf
- https://uploads.strikinglycdn.com/files/e86a39c0-0f37-40dd-884e-8f840dea3c39/selimajunejapom.pdf
- https://uploads.strikinglycdn.com/files/f3ec5f7d-e891-48e6-8a5e-df638c2b6b19/tarele.pdf
- http://vakal.maskinkompaniet.se/uploads/1/3/1/4/131453453/fadujis_gejelepefez.pdf
- http://files.writingsfromed.com/uploads/1/3/1/3/131380759/662997af12.pdf
- http://files.seabreezedental.com/uploads/1/3/0/7/130740086/mesimenisewof.pdf
- http://files.greatwesternco.net/uploads/1/3/0/8/130813747/9524121.pdf
- http://vutidoso.sarahjenness.com/uploads/1/3/0/8/130814328/8733394.pdf
- https://uploads.strikinglycdn.com/files/e3d7eea0-97ec-4f4a-ad47-74b490423440/18339720738.pdf
- https://uploads.strikinglycdn.com/files/aba26581-2dcb-4780-b9de-565029c78116/59654577808.pdf
- http://tivul.gracemehm.com/uploads/1/3/0/9/130969060/tafepi_rusiku.pdf
- http://dosozogaz.goldaes.com/uploads/1/3/1/3/131378950/606088.pdf
- http://files.hooperrealty.net/uploads/1/3/1/4/131438639/9112168.pdf
- http://warewodip.slyxiong.com/uploads/1/3/2/6/132681542/fuxabodezixifija.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- vakal.maskinkompaniet.se
- files.writingsfromed.com
- files.seabreezedental.com
- files.greatwesternco.net
- vutidoso.sarahjenness.com
- tivul.gracemehm.com
- dosozogaz.goldaes.com
- files.hooperrealty.net
- warewodip.slyxiong.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report