SUSPICIOUS — 43855382131.pdf

SUSPICIOUS — 43855382131.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 3e3b14cf4934e575ed094869883d6a9fa13727dbcc8a8ed780087b4756e6af46
• SHA-1: eaf184931e13aeab25cfeb61603ec9b622d20d25
• MD5: 552a5eef625a6bd3566d4b9f081e7515
• ssdeep: 768:TagGzpDDeQEn7xgqTBMR4jJj4fi3X/9dxDFnkljuN3itpyCVWCbg5N:jGFXg7r90fKX/9dxijC3itpygVbg5N
• TLSH: T11A339EF34197EDCC3A876B536DE711986106CB487232A6A049C9B77CC4BC2BD6F11A60
• Submitted as: 43855382131.pdf
• File type: pdf · Size: 48124 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=unique+selling+proposition+pdf, http://files.lutzlearning.com/uploads/1/3/1/0/131070146/kojiguki-vofipifenema-vawilamilapej.pdf, http://files.soulvisionhealing.com/uploads/1/3/1/6/131606630/c985de6.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/strik?keyword=unique+selling+proposition+pdf
• http://files.lutzlearning.com/uploads/1/3/1/0/131070146/kojiguki-vofipifenema-vawilamilapej.pdf
• http://files.soulvisionhealing.com/uploads/1/3/1/6/131606630/c985de6.pdf
• http://files.noon2moon.com/uploads/1/3/1/1/131164198/sojizaroz.pdf
• http://ginewiva.vseen.net/uploads/1/3/0/7/130775176/nazupetudi-gekuxebitejudu.pdf
• http://luzovevi.sharpiepresents.com/uploads/1/3/1/6/131606575/pibalowetera.pdf
• http://files.mrsrenohasclass.com/uploads/1/3/2/6/132681976/2f284.pdf
• http://files.esoterikosparanormal.com/uploads/1/3/0/7/130739922/dorasud.pdf
• http://files.vbacprep.com/uploads/1/3/0/8/130874600/5692271.pdf
• http://gegisa.taconiterocks.com/uploads/1/3/0/8/130874134/103158e361d4.pdf
• http://geweza.freddiequartley.com/uploads/1/3/1/0/131070306/4656935.pdf
• http://renivo.yamatai-taiko.com/uploads/1/3/1/1/131164250/4b1df.pdf
• https://cdn.shopify.com/s/files/1/0476/3402/2566/files/digestive_system_flow_chart_worksheet.pdf
• https://cdn.shopify.com/s/files/1/0478/0825/0015/files/pibetewanixasovem.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• files.lutzlearning.com
• files.soulvisionhealing.com
• files.noon2moon.com
• ginewiva.vseen.net
• luzovevi.sharpiepresents.com
• files.mrsrenohasclass.com
• files.esoterikosparanormal.com
• files.vbacprep.com
• gegisa.taconiterocks.com
• geweza.freddiequartley.com
• renivo.yamatai-taiko.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report