SUSPICIOUS — 69074521640.pdf
SUSPICIOUS — 69074521640.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (66/100). 2 of 54 detection engines flagged it.
Identification
- SHA-256:
47a8523741491a9e12917e2c1e289906c7b3670754970d6416ce4fb3fabd95f6 - SHA-1:
9c5777d75be64b23776d39018e11ab3507d782d8 - MD5:
b1f35c4aee70fc3c47fda1b9cdfcef0e - ssdeep:
768:MgGzpDFpfwffXJAdcIlK1ajtSpwXXZHn3Z1yHnKG77N5I8tsBb6aUfW1:JGFppofNGqwXRnp1yHKGvoD7UfW1 - TLSH:
T172307DF710A7ED8D3A8B6B836EB7029D604ED7897026D7A04488672CC4BC9ED7F10951 - Submitted as: 69074521640.pdf
- File type: pdf · Size: 38125 bytes
- Verdict: suspicious (66/100)
Detections (2 of 54 engines)
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 66/100 is the fusion of 3 weighted signals:
- Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - Embedded network infrastructure: https://gettraff.ru/strik?keyword=exercice+relativit%25C3%25A9+du+mouvement+seconde, https://uploads.strikinglycdn.com/files/658527c7-91de-4941-bc32-b80b78dbfd76/sixikipadovodaduvuxepa.pdf, https://uploads.strikinglycdn.com/files/accc12f9-ea46-4552-8bc7-5c3ef8eb6dbd/14537469588.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/strik?keyword=exercice+relativit%25C3%25A9+du+mouvement+seconde
- https://uploads.strikinglycdn.com/files/658527c7-91de-4941-bc32-b80b78dbfd76/sixikipadovodaduvuxepa.pdf
- https://uploads.strikinglycdn.com/files/accc12f9-ea46-4552-8bc7-5c3ef8eb6dbd/14537469588.pdf
- https://uploads.strikinglycdn.com/files/11cc582d-4e32-4cb9-a331-18c6b729f3cf/57279818552.pdf
- https://uploads.strikinglycdn.com/files/56ceb20c-5504-4d3c-b959-efea692ead5c/tenawevixenuguvitib.pdf
- https://uploads.strikinglycdn.com/files/f196edc9-3966-4edb-afe1-a19de8537402/nucleos_del_talamo_y_sus_funciones.pdf
- https://uploads.strikinglycdn.com/files/b6b72a74-6e12-48c4-9453-f43f1132a8c2/20383548251.pdf
- https://uploads.strikinglycdn.com/files/59a05d48-573f-4390-8588-85264012a174/bozekujaromekabejizomamo.pdf
- https://cdn-cms.f-static.net/uploads/4373509/normal_5f89d1415712c.pdf
- https://cdn-cms.f-static.net/uploads/4366024/normal_5f8c16614056c.pdf
- https://cdn-cms.f-static.net/uploads/4366043/normal_5f8e1e0b53c45.pdf
- https://cdn-cms.f-static.net/uploads/4365607/normal_5f871a2e83da3.pdf
- https://cdn-cms.f-static.net/uploads/4368977/normal_5f8d01fba2fb5.pdf
- https://cdn-cms.f-static.net/uploads/4374843/normal_5f8e4e977db8d.pdf
- https://uploads.strikinglycdn.com/files/c75f6635-d68a-404e-ba6c-763c7eaf5bd8/rinodisobowijufakodaru.pdf
- https://uploads.strikinglycdn.com/files/36f87172-0a7b-4445-bce1-718324d5bc36/tarzhard_the_return.pdf
- https://uploads.strikinglycdn.com/files/12a127f3-afe5-4282-9c9d-18350298b488/66638921538.pdf
- https://uploads.strikinglycdn.com/files/f46684de-6111-45f9-bc47-10804c7a16b2/vilabugukufuj.pdf
- https://uploads.strikinglycdn.com/files/14225be6-9bd1-4095-9a86-a49e3614037a/47669493629.pdf
- https://cdn-cms.f-static.net/uploads/4385613/normal_5f8ea446b7684.pdf
- https://cdn-cms.f-static.net/uploads/4380210/normal_5f8d919d8e8dd.pdf
- https://cdn-cms.f-static.net/uploads/4365570/normal_5f873cb785ce7.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report