SUSPICIOUS — vezoxuto.pdf

SUSPICIOUS — vezoxuto.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 5244a4037f27fe0ccbf369987638f3d8c938a4dabc6e6e340b06918db766780f
• SHA-1: 272f2d8d47ee92bdbd9ff50f747ebec092cd6332
• MD5: bc898f47ef5a3fb24fa64182d3082aa0
• ssdeep: 768:xgGzpDOCt1hi6Jmu9Od9GMVPeKg5cslv1yo8vFKGBi8irIu26jZOc7xrQS:CGFSluod4MVPex/Gq8mIOZOYxrQS
• TLSH: T14532AFF754A7DC4C7A876F47AEA7004AA08AC38C62769370588C776CD47C6FD6E00A60
• Submitted as: vezoxuto.pdf
• File type: pdf · Size: 46215 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=describing+trends+vocabulary+pdf, https://cdn.shopify.com/s/files/1/0432/9940/5979/files/79236890372.pdf, https://cdn.shopify.com/s/files/1/0427/7341/4055/files/42684354057.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/strik?keyword=describing+trends+vocabulary+pdf
• https://cdn.shopify.com/s/files/1/0432/9940/5979/files/79236890372.pdf
• https://cdn.shopify.com/s/files/1/0427/7341/4055/files/42684354057.pdf
• https://cdn.shopify.com/s/files/1/0434/8523/3304/files/la_peur__la_libert_erich_fromm_bib.pdf
• http://files.jessnicolephotography.com/uploads/1/3/0/8/130874680/9ad9a9832994f.pdf
• http://files.lucidletters.com/uploads/1/3/0/8/130874612/3252687.pdf
• http://dituzuzi.agfem-art.com/uploads/1/3/1/8/131857247/102531.pdf
• http://files.halifaxinternalmedicine.com/uploads/1/3/2/7/132740586/bb72eae86c0a05.pdf
• http://files.bccupcakery.com/uploads/1/3/0/7/130738850/xonofikavunimuzisegu.pdf
• http://files.heavygrail.net/uploads/1/3/1/3/131380733/bitat.pdf
• http://files.tiffanyavalosmakeup.com/uploads/1/3/1/4/131483235/6896933.pdf
• http://files.joanadler.com/uploads/1/3/1/1/131163601/dutelaroboluf.pdf
• https://uploads.strikinglycdn.com/files/4a00662c-cb9e-493b-8df7-60e81e7bec69/kejupo.pdf
• https://uploads.strikinglycdn.com/files/28ce9d86-1417-4d02-b0c4-c81e701cb7dd/53707707839.pdf
• https://uploads.strikinglycdn.com/files/467a222d-3f0e-430e-8cd5-384f003c2bac/jibupabilifufopusimafide.pdf
• https://uploads.strikinglycdn.com/files/1a9fc36d-eacf-417e-8c9d-52b6c89e1017/xemozunedajererigojolabis.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• cdn.shopify.com
• files.jessnicolephotography.com
• files.lucidletters.com
• dituzuzi.agfem-art.com
• files.halifaxinternalmedicine.com
• files.bccupcakery.com
• files.heavygrail.net
• files.tiffanyavalosmakeup.com
• files.joanadler.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report