SUSPICIOUS — balirur.pdf
SUSPICIOUS — balirur.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
3b610c3211ac62af71f76af15aea8ae8770410416afcc8b892f6023600aa8756 - SHA-1:
678810b4cb2af287566c93226937a402fd3a761d - MD5:
0db6130dc9e2fc492941698af3ddd5dd - ssdeep:
768:NgGzpD2pPIFmfbNtPys8oreSJCwbuKMNBpvyOnkXPDCqZXlEPxXa5KCkKu2uFIS:uGFCpAoreSJCqMNBwO0PWglaa5cKu2uv - TLSH:
T17D329EF35497ED0CBA8AEB036DEA206A215DC689B132D760548C3B7DC47C67DAE10970 - Submitted as: balirur.pdf
- File type: pdf · Size: 47249 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/wb?keyword=fence%20post%20driver%20tractor%20supply, https://site-1041946.mozfiles.com/files/1041946/3234232014.pdf, https://site-1040260.mozfiles.com/files/1040260/tubutug.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/wb?keyword=fence%20post%20driver%20tractor%20supply
- https://site-1041946.mozfiles.com/files/1041946/3234232014.pdf
- https://site-1040260.mozfiles.com/files/1040260/tubutug.pdf
- https://site-1036858.mozfiles.com/files/1036858/fokevova.pdf
- https://uploads.strikinglycdn.com/files/f4d25f25-d76f-4f31-b1af-23a2cc176139/kelesuwi.pdf
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f8716dfadf82.pdf
- https://cdn-cms.f-static.net/uploads/4365540/normal_5f872fcd70eaa.pdf
- https://cdn-cms.f-static.net/uploads/4368249/normal_5f87834ec39a1.pdf
- https://cdn-cms.f-static.net/uploads/4365555/normal_5f87a78fdb9a4.pdf
- https://site-1042014.mozfiles.com/files/1042014/piwukimusafokogivajiw.pdf
- https://site-1043130.mozfiles.com/files/1043130/pibapikakeru.pdf
- https://site-1043880.mozfiles.com/files/1043880/luzavuzig.pdf
- https://site-1040050.mozfiles.com/files/1040050/67203694603.pdf
- https://site-1038575.mozfiles.com/files/1038575/82639235815.pdf
- https://site-1043404.mozfiles.com/files/1043404/32498376889.pdf
- https://site-1042453.mozfiles.com/files/1042453/38226619130.pdf
- https://site-1037833.mozfiles.com/files/1037833/26155963637.pdf
- https://site-1036839.mozfiles.com/files/1036839/3505124331.pdf
- https://site-1037878.mozfiles.com/files/1037878/bewajavipelerevunovizomep.pdf
- https://site-1038482.mozfiles.com/files/1038482/84204316674.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- ggtraff.ru
- site-1041946.mozfiles.com
- site-1040260.mozfiles.com
- site-1036858.mozfiles.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- site-1042014.mozfiles.com
- site-1043130.mozfiles.com
- site-1043880.mozfiles.com
- site-1040050.mozfiles.com
- site-1038575.mozfiles.com
- site-1043404.mozfiles.com
- site-1042453.mozfiles.com
- site-1037833.mozfiles.com
- site-1036839.mozfiles.com
- site-1037878.mozfiles.com
- site-1038482.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report