SUSPICIOUS — lesomadusemij.pdf

SUSPICIOUS — lesomadusemij.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 4252ffd1788121a7ddb42072af83c6dcdd81751051cd74b1e4804873f49edee5
• SHA-1: d7f9cc463c7ba34cdd31bc868fd2d77766eed9f5
• MD5: 8358c5252f9981c3acb740309292ba1e
• ssdeep: 768:IbgGzpDMVubm7bLa1bSHTzcGwyFwLrzy+6fgZc1smUj9qfzwCcmncuWZE:FGFAYCa1b8bFwn6fg1mC9izwCuuWZE
• TLSH: T1C832BFF35197EC4C7A8A5B47AAE624856181D34C72334A7094D8BB3DC5BC2BDBE60C60
• Submitted as: lesomadusemij.pdf
• File type: pdf · Size: 44897 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=ambiguity+in+english+language+pdf, http://bevura.myclarendonhills.com/uploads/1/3/1/4/131483372/muvikutetudilesekuga.pdf, http://kotuwib.dustinedwards.org/uploads/1/3/1/0/131070604/6351645.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=ambiguity+in+english+language+pdf
• http://bevura.myclarendonhills.com/uploads/1/3/1/4/131483372/muvikutetudilesekuga.pdf
• http://kotuwib.dustinedwards.org/uploads/1/3/1/0/131070604/6351645.pdf
• http://files.abigailcrscott.com/uploads/1/3/1/8/131857734/jiwotugujel-waromanapular-gelaloxamoleler.pdf
• https://site-1037018.mozfiles.com/files/1037018/35329856998.pdf
• https://site-1036691.mozfiles.com/files/1036691/99147142595.pdf
• https://site-1036820.mozfiles.com/files/1036820/tinalevixufarawopuj.pdf
• http://lawixafo.ikhlastours.co.nz/uploads/1/3/2/3/132303093/9422080.pdf
• http://japigag.chrisdelaneymedia.com/uploads/1/3/1/8/131856435/pusuxen.pdf
• http://levaf.definitivearts.net/uploads/1/3/2/6/132680981/fezujijuziwaxuz-jidajepisarira-fawij-xowitamenako.pdf
• http://files.blisjournal.org/uploads/1/3/1/6/131606546/7135d.pdf
• http://files.blackandbrownarebeautiful.com/uploads/1/3/1/6/131637814/musesariziki-keraridom-fetewos.pdf
• http://files.westmorelandks.com/uploads/1/3/2/6/132681352/kunopotujax.pdf
• http://mozikuxoz.rainsweptgame.com/uploads/1/3/1/8/131871721/a5f6708241.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• bevura.myclarendonhills.com
• kotuwib.dustinedwards.org
• files.abigailcrscott.com
• site-1037018.mozfiles.com
• site-1036691.mozfiles.com
• site-1036820.mozfiles.com
• japigag.chrisdelaneymedia.com
• levaf.definitivearts.net
• files.blisjournal.org
• files.blackandbrownarebeautiful.com
• files.westmorelandks.com
• mozikuxoz.rainsweptgame.com
• www.w3.org
• purl.org
• ns.adobe.com
• lawixafo.ikhlastours.co.nz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report