SUSPICIOUS — 96834581898.pdf
SUSPICIOUS — 96834581898.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
44399ca832e23a50369e9018f965f665d2e5c95555060a58a6e5865d0088b0b4 - SHA-1:
9f2f524d65413a34ba1a1ff1709284e20832c798 - MD5:
57c9c79213fb5b369830f1d14c926b21 - ssdeep:
768:GgGzpDbeGJnYxIE4WeMcMPnJoOzF3L1q88bh+eSwOuNyRLy:TGF/eAwIhjMcMPm+F3LNheS1u8RLy - TLSH:
T177306CF354E7DC8CBA879B03ADEB1149508ACB4C613397A45594BB7CC8BC6BD6E40860 - Submitted as: 96834581898.pdf
- File type: pdf · Size: 38723 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=tinkerbell+and+the+pirate+fairy+songs, http://files.mikeligammare.com/uploads/1/3/1/1/131163578/8491377.pdf, http://nodin.ihpawards.com/uploads/1/3/1/4/131406274/4420824.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/strik?keyword=tinkerbell+and+the+pirate+fairy+songs
- http://files.mikeligammare.com/uploads/1/3/1/1/131163578/8491377.pdf
- http://nodin.ihpawards.com/uploads/1/3/1/4/131406274/4420824.pdf
- http://jegumadi.kristaparrpainting.com/uploads/1/3/1/4/131453194/f0fdc7ec3a33de1.pdf
- http://files.imarihardon.com/uploads/1/3/1/1/131163691/c496708c9.pdf
- https://site-1037241.mozfiles.com/files/1037241/91603938947.pdf
- https://site-1040990.mozfiles.com/files/1040990/77458121805.pdf
- https://site-1037192.mozfiles.com/files/1037192/98504959285.pdf
- https://site-1037251.mozfiles.com/files/1037251/fativepawijiranuwijosixud.pdf
- https://site-1036698.mozfiles.com/files/1036698/fudirusepudoxuji.pdf
- https://site-1040574.mozfiles.com/files/1040574/sarosabinasikikuxoxiwep.pdf
- https://site-1040224.mozfiles.com/files/1040224/3267359738.pdf
- https://site-1048292.mozfiles.com/files/1048292/nigikilisesosomas.pdf
- https://site-1041281.mozfiles.com/files/1041281/lusugewupazabawumufe.pdf
- https://site-1039785.mozfiles.com/files/1039785/zosisufixejafilibopipaguz.pdf
- http://jurodogex.pocdogs.com/uploads/1/3/1/4/131453741/7246010.pdf
- http://files.sncounselor.com/uploads/1/3/0/7/130775115/2296520.pdf
- http://files.atp-pro.com/uploads/1/3/2/7/132741128/kizakibe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- files.mikeligammare.com
- nodin.ihpawards.com
- jegumadi.kristaparrpainting.com
- files.imarihardon.com
- site-1037241.mozfiles.com
- site-1040990.mozfiles.com
- site-1037192.mozfiles.com
- site-1037251.mozfiles.com
- site-1036698.mozfiles.com
- site-1040574.mozfiles.com
- site-1040224.mozfiles.com
- site-1048292.mozfiles.com
- site-1041281.mozfiles.com
- site-1039785.mozfiles.com
- jurodogex.pocdogs.com
- files.sncounselor.com
- files.atp-pro.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report