SUSPICIOUS — natalya_kovaleva_saradas_vip.pdf

SUSPICIOUS — natalya_kovaleva_saradas_vip.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 43cf5b38e8f6caf3491fcd5792d6d5b55a0a93476a106d13ff81375c84658cb3
• SHA-1: cc96eec11e21f375d420c51d66e0bdd3a4719c7e
• MD5: bc67f831b72308687e5727eede495846
• ssdeep: 768:1gGzpDXepw7ltocKqxinJH/ChiWqtekJgGvJP2JntzsxRX9maqGhyaP:mGFDeT/ChNGvJ0ntzsrXRqGhyaP
• TLSH: T19E316CF350A7ED4C7B8F9B03ADAB115DA48AD78DA03397900498672CD4AC9BD7F00A51
• Submitted as: natalya_kovaleva_saradas_vip.pdf
• File type: pdf · Size: 43045 bytes
• Verdict: suspicious (35/100)

Detections (2 of 53 engines)

• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 35/100 is the fusion of 2 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=natalya+kovaleva+saradas+vip, https://cdn-cms.f-static.net/uploads/4384320/normal_5f8dc45c5dded.pdf, https://cdn-cms.f-static.net/uploads/4379726/normal_5f8d7c51dccea.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/strik?keyword=natalya+kovaleva+saradas+vip
• https://cdn-cms.f-static.net/uploads/4384320/normal_5f8dc45c5dded.pdf
• https://cdn-cms.f-static.net/uploads/4379726/normal_5f8d7c51dccea.pdf
• https://cdn-cms.f-static.net/uploads/4365525/normal_5f878e6cb2dbf.pdf
• https://cdn-cms.f-static.net/uploads/4369153/normal_5f8a03e7d519e.pdf
• https://cdn-cms.f-static.net/uploads/4366976/normal_5f8730584e94d.pdf
• https://cdn.shopify.com/s/files/1/0494/3288/7463/files/mujeres_de_la_biblia_jw.pdf
• https://cdn.shopify.com/s/files/1/0431/8488/1825/files/the_last_leaf_o_henry_download.pdf
• https://cdn.shopify.com/s/files/1/0428/6342/7751/files/kaledenejulijabugomemez.pdf
• https://cdn.shopify.com/s/files/1/0496/4057/1029/files/wuginutawisasuredi.pdf
• https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/4802602.pdf
• https://kinojapi.weebly.com/uploads/1/3/2/3/132302846/rasexinaxizipurepis.pdf
• https://degujipimisa.weebly.com/uploads/1/3/1/4/131453395/9176008.pdf
• https://meboguvogo.weebly.com/uploads/1/3/1/4/131437667/ribepodo_vajukesawe_wimipegiduwut_sivaxube.pdf
• https://xujaxivef.weebly.com/uploads/1/3/1/4/131438557/sikalerewalukupis.pdf
• https://zizuralozirufu.weebly.com/uploads/1/3/1/4/131483034/kubuvevizabibujaz.pdf
• https://xebikazogede.weebly.com/uploads/1/3/2/7/132740990/6d371b4a243e2c5.pdf
• https://mixorone.weebly.com/uploads/1/3/1/4/131438240/260142.pdf
• https://cdn.shopify.com/s/files/1/0483/8123/1264/files/67121474606.pdf
• https://cdn.shopify.com/s/files/1/0437/1428/1625/files/42545321647.pdf
• https://cdn.shopify.com/s/files/1/0437/0530/3190/files/march_of_empires_alliance_guide.pdf
• https://cdn.shopify.com/s/files/1/0500/9086/8901/files/tennis_video_games_xbox_one.pdf
• https://cdn.shopify.com/s/files/1/0483/0612/7003/files/pikote.pdf
• https://uploads.strikinglycdn.com/files/fa98ee17-c12f-4e55-862f-d2635b310895/5272809733.pdf
• https://uploads.strikinglycdn.com/files/0f0ac331-5741-4495-9316-ddab0806d55c/71291742875.pdf

Embedded domains

• cctraff.ru
• cdn-cms.f-static.net
• cdn.shopify.com
• fodezamu.weebly.com
• kinojapi.weebly.com
• degujipimisa.weebly.com
• meboguvogo.weebly.com
• xujaxivef.weebly.com
• zizuralozirufu.weebly.com
• xebikazogede.weebly.com
• mixorone.weebly.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report