SUSPICIOUS — comfort_aire_dehumidifier_manual.pdf
SUSPICIOUS — comfort_aire_dehumidifier_manual.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
42abd94d091099032cbf239e7a4dec954090f0b9a71d3875836ee409827d01a7 - SHA-1:
e5b6118a7a0882be0e7aa8da5cae32c56aa376f4 - MD5:
0d25d993aa1ae06afb74cd2baa225c71 - ssdeep:
1536:QA8GZ0xYYT3dn1mUAkPmRaM4mml8VzWPhcnZtvgJPnPdQAMtvpbf:38G+xY+1m134jl8N6hc7vgJ/PnEF - TLSH:
T11238CFF315A3DD4CB98B8B537DBE266C948ED6486232DF60518C636C84BC6EE7D10A40 - Submitted as: comfort_aire_dehumidifier_manual.pdf
- File type: pdf · Size: 80556 bytes
- Verdict: suspicious (44/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!0D25D993AA1A
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://leonvi.ru/strik?utm_term=comfort+aire+dehumidifier+manual, http://dorulezebum.sportsontheweb.net/81631239591.pdf, https://uploads.strikinglycdn.com/files/0fc6e5bc-0b43-4823-a6a7-bce406cc9509/how_to_solve_capital_budgeting_payback_period.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://leonvi.ru/strik?utm_term=comfort+aire+dehumidifier+manual
- http://dorulezebum.sportsontheweb.net/81631239591.pdf
- https://uploads.strikinglycdn.com/files/0fc6e5bc-0b43-4823-a6a7-bce406cc9509/how_to_solve_capital_budgeting_payback_period.pdf
- https://s3.amazonaws.com/bejexe/54973068853.pdf
- http://copyright-help-report.com/2018_lexus_gx_460_trunk_dimensionsek5yd.pdf
- https://cdn-cms.f-static.net/uploads/4423454/normal_6068eaf67259c.pdf
- http://niwopofe.scienceontheweb.net/administrative_office_management_complete_course.pdf
- https://s3.amazonaws.com/varolexexus/structure_of_neuron_worksheet.pdf
- http://basagutidabe.sportsontheweb.net/advocacy_for_mental_health.pdf
- http://vivadoctor.ru/61340749480bgz54.pdf
- https://uploads.strikinglycdn.com/files/95f5631a-c57e-4ac3-8d30-edfaed9a7bfa/is_there_a_me_before_you_sequel.pdf
- https://uploads.strikinglycdn.com/files/be9a5321-a3dd-42cb-9d95-127cb1260aae/90646656225.pdf
- https://uploads.strikinglycdn.com/files/185e17fa-a4c4-4b78-9d43-6a03879e69ad/disney_world_crowd_calendar_december_2019.pdf
- https://uploads.strikinglycdn.com/files/10a3b161-ba04-40a1-bc36-98cedf2e6039/15773911372.pdf
- http://pycnidwzxc.info/50713488257o8ju2.pdf
- https://s3.amazonaws.com/wunupalezozerud/dajujesejinav.pdf
- https://cdn-cms.f-static.net/uploads/4393638/normal_6053c931d8475.pdf
- https://s3.amazonaws.com/zafijukopa/graco_solano_4-in-1_convertible_crib_white.pdf
- https://cdn-cms.f-static.net/uploads/4418180/normal_5fdb2eeda0cb9.pdf
- http://sberbank.services/l_anorexie_mentale5gf3h.pdf
- http://stroiline74.ru/hayward_h250_pool_heater_service_lightwncf3.pdf
- https://s3.amazonaws.com/nafoxuda/givoxeduwokilena.pdf
- http://thedefenseforge.com/59685492099u80d6.pdf
- http://tufofol.medianewsonline.com/mahatma_gandhi_biography.pdf
- http://sushibara.net/phet_density_worksheet_answersplm9f.pdf
Embedded domains
- leonvi.ru
- dorulezebum.sportsontheweb.net
- uploads.strikinglycdn.com
- s3.amazonaws.com
- copyright-help-report.com
- cdn-cms.f-static.net
- niwopofe.scienceontheweb.net
- basagutidabe.sportsontheweb.net
- vivadoctor.ru
- pycnidwzxc.info
- stroiline74.ru
- thedefenseforge.com
- tufofol.medianewsonline.com
- sushibara.net
- mibikazut.mypressonline.com
- naykaryadom.fun
- helplnstagramcontact6088758.com
- www.w3.org
- purl.org
- ns.adobe.com
- sberbank.services
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report