SUSPICIOUS — 68052620283.pdf

SUSPICIOUS — 68052620283.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 3e37fcfa08925cfb504d95c4ced23ef6835c276ce670f201eb3631e4a4f0664e
• SHA-1: b4eb9c4b6cc3595bd8d2b384f6bc9465771c6953
• MD5: b3820c84b3e9636bbd7f078313b1887c
• ssdeep: 768:+gGzpDPOeThFQ6NcS17gssLMjuur4B9FRkkY4dqFksXX1tjl2glwM9Rg:7GFzKHLMjF0HkkYsqVEglf9Rg
• TLSH: T17832AEF34067DD8C6AC7AB13ADEA245D619AD7593132DB206AC4736CC4BC2BDBE10910
• Submitted as: 68052620283.pdf
• File type: pdf · Size: 47075 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=adobe+pdf+maker+app, https://cdn.shopify.com/s/files/1/0438/9853/6091/files/21788938353.pdf, https://cdn.shopify.com/s/files/1/0430/6688/4250/files/75429865475.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=adobe+pdf+maker+app
• https://cdn.shopify.com/s/files/1/0438/9853/6091/files/21788938353.pdf
• https://cdn.shopify.com/s/files/1/0430/6688/4250/files/75429865475.pdf
• https://cdn.shopify.com/s/files/1/0432/2122/1539/files/83533010813.pdf
• https://cdn.shopify.com/s/files/1/0445/8423/9268/files/soxeporik.pdf
• https://cdn.shopify.com/s/files/1/0481/6951/7207/files/watch_call_me_by_your_name_online_free_google_drive.pdf
• https://cdn.shopify.com/s/files/1/0428/8184/3356/files/hamilton_beach_flexbrew_manual_49983.pdf
• https://cdn.shopify.com/s/files/1/0438/9673/3864/files/rigoka.pdf
• https://cdn.shopify.com/s/files/1/0460/9707/2292/files/tuxaxux.pdf
• https://cdn.shopify.com/s/files/1/0431/7144/6948/files/agreement_of_sale_format.pdf
• http://files.staugustinereed.org/uploads/1/3/1/4/131406365/bff03f630412099.pdf
• http://butinigup.cchpcharleswood.org/uploads/1/3/0/8/130873843/fobofiro.pdf
• https://site-1037120.mozfiles.com/files/1037120/tezivexufupareruxasevuso.pdf
• https://site-1036698.mozfiles.com/files/1036698/paraviduwosi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• cdn.shopify.com
• files.staugustinereed.org
• butinigup.cchpcharleswood.org
• site-1037120.mozfiles.com
• site-1036698.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report