SUSPICIOUS — zosev.pdf

SUSPICIOUS — zosev.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 2a15dd8e776b5f151b8576b14097c1eff244001c5812026413b7153f7750f78a
• SHA-1: 8649340d03a34121815d8b86fb4a817eee46f8cd
• MD5: dceefde23351df09a7c0adf9fc4c9d53
• ssdeep: 768:ugGzpDzJ0PK/JxZGxK+8uwJZgIAx7G7+0PJX3sdE6TVFQeI4LP:LGFP7h+8FZg57cNd8VFQD4LP
• TLSH: T1AD329EF310A7DC5C3E87DB536FA610A9A089D3885133AA64199877BCC47C3FDAE50911
• Submitted as: zosev.pdf
• File type: pdf · Size: 44448 bytes
• Verdict: suspicious (44/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=askep+atresia+ani+pada+bayi+pdf, https://site-1037073.mozfiles.com/files/1037073/tamarosi.pdf, https://site-1037828.mozfiles.com/files/1037828/robotasozomumipepat.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=askep+atresia+ani+pada+bayi+pdf
• https://site-1037073.mozfiles.com/files/1037073/tamarosi.pdf
• https://site-1037828.mozfiles.com/files/1037828/robotasozomumipepat.pdf
• https://site-1038493.mozfiles.com/files/1038493/41158489285.pdf
• http://files.paoniacherrydays.com/uploads/1/3/1/4/131453019/4475286.pdf
• http://files.etopp13.org/uploads/1/3/0/7/130775565/tedosakewerorep.pdf
• http://vonow.haleyhumphrey.com/uploads/1/3/1/3/131381135/305160.pdf
• http://rozukud.bluewaterfmchurch.com/uploads/1/3/0/7/130775997/0f6063e.pdf
• http://subotu.catcaricature.studio/uploads/1/3/1/3/131398252/xurutizidumirebox.pdf
• http://files.michaelallancharles.com/uploads/1/3/1/8/131857115/zejexok.pdf
• http://xapuru.mysuidora.com/uploads/1/3/1/4/131437626/nonumodawizerafos.pdf
• http://files.concretebendoregon.net/uploads/1/3/2/8/132814241/0e5ef632035bee5.pdf
• http://files.patriciahelderministries.com/uploads/1/3/1/4/131483218/wowigiz.pdf
• http://files.tobyupci.com/uploads/1/3/2/6/132696018/100ff90e6acca6.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• site-1037073.mozfiles.com
• site-1037828.mozfiles.com
• site-1038493.mozfiles.com
• files.paoniacherrydays.com
• files.etopp13.org
• vonow.haleyhumphrey.com
• rozukud.bluewaterfmchurch.com
• files.michaelallancharles.com
• xapuru.mysuidora.com
• files.concretebendoregon.net
• files.patriciahelderministries.com
• files.tobyupci.com
• www.w3.org
• purl.org
• ns.adobe.com
• subotu.catcaricature.studio

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report