SUSPICIOUS — 45139864761.pdf

SUSPICIOUS — 45139864761.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 35f3c5c58c356c794daa552568da005d3cbaa9454fb6d9db4c94acad1f4fa0f8
• SHA-1: 0179c26a1f6c48a524036102542fa50c7c75221e
• MD5: 0bcbf57f47e43cda65120207cf788f80
• ssdeep: 1536:uGFJ7aT1tONVlUeUuUgDCg8LNqxACcAj:XFJ7sENVlmuTCRLNpCl
• TLSH: T1F635CFF3A997DC9CBACAAB03ACEA1164505AC74C6132E66054CCB66CC47C2FC7F51861
• Submitted as: 45139864761.pdf
• File type: pdf · Size: 59615 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=quicken+willmaker+plus+2017+free+download, http://files.claradecapua.com/uploads/1/3/1/8/131858592/sogakolazazap.pdf, http://files.counterpunchparkinsons.com/uploads/1/3/0/7/130739777/44ec330f.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/strik?keyword=quicken+willmaker+plus+2017+free+download
• http://files.claradecapua.com/uploads/1/3/1/8/131858592/sogakolazazap.pdf
• http://files.counterpunchparkinsons.com/uploads/1/3/0/7/130739777/44ec330f.pdf
• http://movovu.jessietaylordesigns.com/uploads/1/3/1/3/131380591/849c992623f3d.pdf
• http://files.createfairtrade.com/uploads/1/3/0/8/130874284/ee4caf6632.pdf
• https://uploads.strikinglycdn.com/files/435ae5bb-83c9-406d-8435-f49565767d55/42633869390.pdf
• https://uploads.strikinglycdn.com/files/60fba771-3806-48cd-a8b7-53305a593b9c/79163186557.pdf
• http://files.kimsplaceco.com/uploads/1/3/2/7/132740327/f29fbf72079c6.pdf
• http://navew.taiwanhotelnews.com/uploads/1/3/0/8/130813714/pumenixuwifo.pdf
• http://weziwebe.aprayerdiary.net/uploads/1/3/0/8/130813632/dagisatuxasovun.pdf
• http://files.elmwoodpubliclibrary.org/uploads/1/3/0/7/130775557/1162030.pdf
• https://cdn.shopify.com/s/files/1/0454/2939/1516/files/80308521829.pdf
• https://cdn.shopify.com/s/files/1/0492/4660/1372/files/6334694685.pdf
• https://cdn.shopify.com/s/files/1/0432/9072/2454/files/kolituresobutenemi.pdf
• https://cdn.shopify.com/s/files/1/0432/7977/7945/files/vexunavafemifunib.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• files.claradecapua.com
• files.counterpunchparkinsons.com
• movovu.jessietaylordesigns.com
• files.createfairtrade.com
• uploads.strikinglycdn.com
• files.kimsplaceco.com
• navew.taiwanhotelnews.com
• weziwebe.aprayerdiary.net
• files.elmwoodpubliclibrary.org
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report