SUSPICIOUS — xuxuxedoxiv.pdf

SUSPICIOUS — xuxuxedoxiv.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 31e5c197abe5869c9a1c3d36b8b20d827ad800588d82f600ac78e90d6bcdabe8
• SHA-1: 96aa03bb5017390066daee5549563c969fae5c7e
• MD5: 949dd8ada0d193a8616e5b2115b0e508
• ssdeep: 768:QgGzpDYgQLEgNp2J1e8U6YfYYoVgxuaoYNQSkYhfqT8ZijheRGRmZNWqDlB1rjTR:9GF09DAeujrSkYhCT1jhpmZ9DvpgZTY
• TLSH: T140328DF31067EDCC2A8BAB13BEE611595445DA8C7136DAF04998373CC4B86FDAE00A51
• Submitted as: xuxuxedoxiv.pdf
• File type: pdf · Size: 43600 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=devexpress+mvc+gridview+manually+paging, https://cdn.shopify.com/s/files/1/0436/3649/0398/files/baforaborobutalekaw.pdf, https://cdn.shopify.com/s/files/1/0431/6463/1189/files/korean_thank_you_for_your_hard_work.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=devexpress+mvc+gridview+manually+paging
• https://cdn.shopify.com/s/files/1/0436/3649/0398/files/baforaborobutalekaw.pdf
• https://cdn.shopify.com/s/files/1/0431/6463/1189/files/korean_thank_you_for_your_hard_work.pdf
• https://cdn.shopify.com/s/files/1/0430/6327/9767/files/man_into_woman_book.pdf
• https://cdn.shopify.com/s/files/1/0437/2974/8117/files/bexogirofurafidojirixe.pdf
• https://cdn.shopify.com/s/files/1/0437/1293/8152/files/tidajobevu.pdf
• https://cdn.shopify.com/s/files/1/0482/6198/8507/files/49978018623.pdf
• https://cdn.shopify.com/s/files/1/0429/7926/2623/files/newegg_military_discounts.pdf
• https://cdn.shopify.com/s/files/1/0432/8282/5376/files/36959524023.pdf
• https://cdn.shopify.com/s/files/1/0494/6824/4135/files/middle_school_journalism_syllabus.pdf
• https://cdn.shopify.com/s/files/1/0478/1254/2623/files/zosezopikemevop.pdf
• https://cdn.shopify.com/s/files/1/0483/8794/8693/files/taco_bell.pdf
• https://cdn.shopify.com/s/files/1/0434/5747/8809/files/ladipe.pdf
• https://cdn.shopify.com/s/files/1/0438/1048/8477/files/taxevinemaputugogede.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report