SUSPICIOUS — abc_s_of_christian_growth_free_downl.pdf
SUSPICIOUS — abc_s_of_christian_growth_free_downl.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
31451a8b28f86500c7d6f7e79c0d43d2c575be33b0b5597774d68eac50e4bf3d - SHA-1:
91777cd0c989368285d4fa451ec8e681b7598026 - MD5:
4ce5a4d9bacf93a68c7aff85c8fed2a9 - ssdeep:
768:TgGzpDzp30Vy9AbjxxbAAlPwyzkjr9aTWj/KXswQ5M6Xs:sGFnpEY9AJxbAAl9Wr9aTKKlQi6Xs - TLSH:
T1D0318DF35087DC8C7A8E6B03ADAA159E608BC38D7133D650459C722DD0BCAEE3E10961 - Submitted as: abc_s_of_christian_growth_free_downl.pdf
- File type: pdf · Size: 40935 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/strik?keyword=abc+s+of+christian+growth+free+downl, https://gozofuma.weebly.com/uploads/1/3/0/8/130874065/541746.pdf, https://zidabowejixu.weebly.com/uploads/1/3/1/1/131163559/6932602.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/strik?keyword=abc+s+of+christian+growth+free+downl
- https://gozofuma.weebly.com/uploads/1/3/0/8/130874065/541746.pdf
- https://zidabowejixu.weebly.com/uploads/1/3/1/1/131163559/6932602.pdf
- https://kabudededawizo.weebly.com/uploads/1/3/1/3/131383409/komub.pdf
- https://fofafobef.weebly.com/uploads/1/3/4/3/134349457/vadusudefiz.pdf
- https://uploads.strikinglycdn.com/files/28782e3c-7915-4d48-a4c8-b100f099ae04/29139198158.pdf
- https://uploads.strikinglycdn.com/files/ca078a9f-facb-44cd-bd9d-e2494ac9a421/kilugovenadofonelonaliv.pdf
- https://uploads.strikinglycdn.com/files/18c18deb-aaa9-415c-a1e5-cc58fdf22323/minijopiwituxikobarafe.pdf
- https://uploads.strikinglycdn.com/files/0db26c3b-ca4a-48c7-9569-78f91003ffa2/xagoraxot.pdf
- https://uploads.strikinglycdn.com/files/3afc27b4-db1d-4fc3-9eb0-d45a1247d187/pythagorean_spiral_project_ideas.pdf
- https://uploads.strikinglycdn.com/files/417ad904-22fa-408b-ad52-239eed86800f/wewekiwuzexatiseva.pdf
- https://uploads.strikinglycdn.com/files/6d745725-2070-4423-bd04-38732bf261fc/fiwapujunivilofumexod.pdf
- https://uploads.strikinglycdn.com/files/38a21262-20d0-49cb-9acd-649dad9541d9/15868118280.pdf
- https://uploads.strikinglycdn.com/files/2e7ea158-d575-4587-ba38-1eecd729a684/49172504175.pdf
- https://uploads.strikinglycdn.com/files/48704e88-ac92-48f5-a5dd-932a8607f441/mibimunigagose.pdf
- https://uploads.strikinglycdn.com/files/30b950f8-002d-4186-85b9-8fee21c67c6c/9004440002.pdf
- https://fizolapojola.weebly.com/uploads/1/3/1/3/131383549/jijivijibizozugokow.pdf
- https://derodaju.weebly.com/uploads/1/3/1/6/131606282/dobipa.pdf
- https://mumixopid.weebly.com/uploads/1/3/1/8/131872042/runet.pdf
- https://tivexafo.weebly.com/uploads/1/3/4/3/134348633/fomupazut.pdf
- https://s3.amazonaws.com/wonoti/29618589119.pdf
- https://s3.amazonaws.com/pesetufavo/ataxia_espinocerebelosa_tipo_6.pdf
- https://s3.amazonaws.com/xanebavifamopez/nexusifegodokip.pdf
- https://s3.amazonaws.com/dazinibonofobi/furufinarefipeb.pdf
- https://s3.amazonaws.com/pazifetanegapu/excel_exercises_for_students.pdf
Embedded domains
- cctraff.ru
- gozofuma.weebly.com
- zidabowejixu.weebly.com
- kabudededawizo.weebly.com
- fofafobef.weebly.com
- uploads.strikinglycdn.com
- fizolapojola.weebly.com
- derodaju.weebly.com
- mumixopid.weebly.com
- tivexafo.weebly.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report