SUSPICIOUS — 73028533329.pdf

SUSPICIOUS — 73028533329.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 2d82fb68c9fd7cbb663211af01e7eb72731a4fd66c650ef6f8d6c617ad29571f
• SHA-1: e8cf3b5c4003115839c33b2eb6948aba97a5457e
• MD5: 01aeec1893192e5d072830b19e2ccf42
• ssdeep: 768:wgGzpDjhj62FBO5YXyMjR9e8mtF1fgnZr5uCPWKczt:dGFPVgYXyGjmVf+ZNuCPWKczt
• TLSH: T109318DF3506BED8C3A97AB032DE610984185D7487023A7A455D97B7DC8BC6FCAE90870
• Submitted as: 73028533329.pdf
• File type: pdf · Size: 40556 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=fun+maths+worksheets+year+8, https://site-1043375.mozfiles.com/files/1043375/48205134319.pdf, https://site-1039393.mozfiles.com/files/1039393/bufes.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/strik?keyword=fun+maths+worksheets+year+8
• https://site-1043375.mozfiles.com/files/1043375/48205134319.pdf
• https://site-1039393.mozfiles.com/files/1039393/bufes.pdf
• https://site-1038910.mozfiles.com/files/1038910/difanuzutodafawuxosadi.pdf
• https://site-1039778.mozfiles.com/files/1039778/76410811290.pdf
• http://xunut.startherup.org/uploads/1/3/2/6/132695569/82de690b10ec7.pdf
• http://labeg.ibelieveinbirth.com/uploads/1/3/2/6/132682646/tumopave.pdf
• http://files.serinoh.org/uploads/1/3/2/6/132695836/rowoge-zipiwuja-vorerelunagut.pdf
• http://paduwugi.game.myworldrules.com/uploads/1/3/1/4/131438800/643ea635e.pdf
• http://xodugik.mooneyhistory.com/uploads/1/3/1/1/131164131/a9b36c4c4f1f.pdf
• http://files.630shistory.com/uploads/1/3/0/7/130776599/9361511.pdf
• http://files.embracingliterature.com/uploads/1/3/0/7/130740586/3017a97b2738.pdf
• http://xamiwisok.valeriemaserflanagan.com/uploads/1/3/1/4/131406841/zubefafuz-rafakopej-nujigediwidi.pdf
• http://files.wbc2018.org/uploads/1/3/0/7/130775249/levimalubawu.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• site-1043375.mozfiles.com
• site-1039393.mozfiles.com
• site-1038910.mozfiles.com
• site-1039778.mozfiles.com
• xunut.startherup.org
• labeg.ibelieveinbirth.com
• files.serinoh.org
• paduwugi.game.myworldrules.com
• xodugik.mooneyhistory.com
• files.630shistory.com
• files.embracingliterature.com
• xamiwisok.valeriemaserflanagan.com
• files.wbc2018.org
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report