SUSPICIOUS — 45358029636.pdf
SUSPICIOUS — 45358029636.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
562c2b43de5ab288ee6bb6361fec9cc770bddf655a66eb3da91daa2a54d61de0 - SHA-1:
b36c0a2b5f816b7f3b31cf778c9d313490ab7b2b - MD5:
40a55c74f85f7bb14c8e165f0553616e - ssdeep:
768:jgGzpDqZrNXnlCIrcR1LwjOfNM6VG5dTrouwfbR8YqsOkCC:cGF+ZGlHOOvGvTrf8+YqsOkCC - TLSH:
T1C8318EF7108BED88BA8EAB075E9A055D5149C38C713792B019C8376CC9BC6FC6F41962 - Submitted as: 45358029636.pdf
- File type: pdf · Size: 40748 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=forensic+toxicology+textbook+pdf, http://bivop.ywampotch.com/uploads/1/3/1/4/131438617/rawuz.pdf, http://mewoxuz.qbedsandbedding.com/uploads/1/3/1/3/131383721/3455878.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://ggtraff.ru/strik?keyword=forensic+toxicology+textbook+pdf
- http://bivop.ywampotch.com/uploads/1/3/1/4/131438617/rawuz.pdf
- http://mewoxuz.qbedsandbedding.com/uploads/1/3/1/3/131383721/3455878.pdf
- http://files.kellyboyle.info/uploads/1/3/1/4/131438206/1207945.pdf
- https://cdn.shopify.com/s/files/1/0477/0994/6012/files/banedinimora.pdf
- https://uploads.strikinglycdn.com/files/a5f42c0d-7bd4-44c4-a623-cc261a74717d/nidelijevenomel.pdf
- https://uploads.strikinglycdn.com/files/9947fa28-8fcb-4295-bd3e-99b776713f91/sokimazotakeretufikoxoso.pdf
- https://uploads.strikinglycdn.com/files/a7a56fac-cf1b-4d49-b3cc-509bd3645b1c/33971307415.pdf
- https://uploads.strikinglycdn.com/files/081f6631-798f-4904-aa81-4be612def775/kazurujabamefuzisimafu.pdf
- https://uploads.strikinglycdn.com/files/f44bba4e-2b4f-4742-8d84-c820536ee12a/23029980914.pdf
- https://uploads.strikinglycdn.com/files/d9c23f2f-6a99-485d-8cff-123e330f4f89/kojux.pdf
- https://uploads.strikinglycdn.com/files/23935c89-e444-4202-8228-eca2d8b629d7/jasonukazawupiwemebebi.pdf
- https://uploads.strikinglycdn.com/files/69c620e6-bde3-47cf-a16d-e148f2a0dbd1/64602623253.pdf
- https://uploads.strikinglycdn.com/files/6d640f83-8233-4a00-a74e-04cd094447e5/5152535568.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- bivop.ywampotch.com
- mewoxuz.qbedsandbedding.com
- files.kellyboyle.info
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report