SUSPICIOUS — vojekeditoded.pdf

SUSPICIOUS — vojekeditoded.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 2e64d1d2210310bad8b72c3dbfe16d4f4da19ecce3ceca6b0684653744b76c0d
• SHA-1: ebe8e4681210db3bf646807f98153578c8791551
• MD5: b957fccb46a68ce320b2d50e3d0e435c
• ssdeep: 1536:BGFThyAX4wwQmp9QmfjEfGTTfhfi69Sum9:kFT/X49nQmLEfG3panuU
• TLSH: T1B234A0F311ABEDCC7A876F4368A61199608AD6C8313297A058D8BB3DC57C1FD6F40921
• Submitted as: vojekeditoded.pdf
• File type: pdf · Size: 55494 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=pdf+orthographe+francais, http://sodet.mandrcatering.com/uploads/1/3/1/4/131453850/vower-jurineragagug.pdf, http://files.southerncoloradohrc.com/uploads/1/3/1/3/131384116/rorelipat.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/strik?keyword=pdf+orthographe+francais
• http://sodet.mandrcatering.com/uploads/1/3/1/4/131453850/vower-jurineragagug.pdf
• http://files.southerncoloradohrc.com/uploads/1/3/1/3/131384116/rorelipat.pdf
• http://files.abnerhershberger.com/uploads/1/3/2/7/132710759/8611970.pdf
• http://files.graceub.com/uploads/1/3/2/6/132681404/6733747.pdf
• http://juwitodi.englishlearners101.com/uploads/1/3/1/1/131164269/pusajizipez-damoputabutera-kirogezu.pdf
• http://files.middletonelementary.org/uploads/1/3/1/1/131164558/rilujidupuveroj.pdf
• http://files.vintageorders.com/uploads/1/3/0/8/130873907/3e8f3.pdf
• http://vijaz.barnsandburleycandleco.com/uploads/1/3/0/7/130775386/7f2304706a17.pdf
• https://cdn.shopify.com/s/files/1/0434/4306/0901/files/bidufimokaziw.pdf
• https://cdn.shopify.com/s/files/1/0432/2869/2643/files/the_fat_rat_mp3_song_free_download.pdf
• https://uploads.strikinglycdn.com/files/d1906980-2b5d-45d2-9fd3-59b4212779ba/xelerob.pdf
• https://uploads.strikinglycdn.com/files/3e3c84f5-fe71-433a-9ab4-3122fb04a108/sagujaxosogerozare.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• sodet.mandrcatering.com
• files.southerncoloradohrc.com
• files.abnerhershberger.com
• files.graceub.com
• juwitodi.englishlearners101.com
• files.middletonelementary.org
• files.vintageorders.com
• vijaz.barnsandburleycandleco.com
• cdn.shopify.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report