SUSPICIOUS — vetuvaduse.pdf

SUSPICIOUS — vetuvaduse.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 568c77dd9eb28e29e49ba1e3b0b3d480d699b554db11486fac2a618ff839b4b6
• SHA-1: 3c5df72783f6e54904547b07505b632d1ad42061
• MD5: 5e33da07993ee5a45e0a2b55f7f489b8
• ssdeep: 768:ygGzpD6pfh9DCfTT+TT6JYSGhzUtJgxR/0gbxKO8F:vGFWpfWQQtEVHFKO8F
• TLSH: T1B2319DF34897DD8C7A869753ADAA0558218AC68C6137E730289D372CC4BC2FDBE41961
• Submitted as: vetuvaduse.pdf
• File type: pdf · Size: 39345 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=diablo+2+crack+1.12, https://uploads.strikinglycdn.com/files/d46ce4fc-3da3-4577-85a6-adfb2207c06b/82611463213.pdf, https://uploads.strikinglycdn.com/files/0bfee84f-2a62-42de-9915-a4c35815a8dd/20452716958.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/strik?keyword=diablo+2+crack+1.12
• https://uploads.strikinglycdn.com/files/d46ce4fc-3da3-4577-85a6-adfb2207c06b/82611463213.pdf
• https://uploads.strikinglycdn.com/files/0bfee84f-2a62-42de-9915-a4c35815a8dd/20452716958.pdf
• https://uploads.strikinglycdn.com/files/fa75c319-a2e7-4df7-8eeb-0e207258e626/mewewebobupalu.pdf
• https://uploads.strikinglycdn.com/files/baaee85b-572e-438d-b1e7-da8c9f5cfd50/23547198420.pdf
• https://uploads.strikinglycdn.com/files/e3ae6d65-102c-4490-b86e-63ff49a9b7d5/86469462334.pdf
• http://files.geekygiftbaskets.com/uploads/1/3/1/4/131453294/5172596.pdf
• http://bewukare.laidlawlandscape.com/uploads/1/3/2/8/132815828/ac5608553f7.pdf
• http://murexixig.davidschagun.com/uploads/1/3/0/9/130969862/jugadamenu_birajutukavavuz.pdf
• http://xasiwe.elizabethmallia.com/uploads/1/3/1/4/131406270/luwubedizosum.pdf
• http://files.domesticdivapropertymanagement.com/uploads/1/3/1/4/131453713/zupulosub_novikapibi_gavalimex_pepematonusuzo.pdf
• http://vowaw.traversebaygroup.com/uploads/1/3/0/9/130969060/garobelon.pdf
• https://cdn.shopify.com/s/files/1/0428/4982/9023/files/77963070798.pdf
• https://cdn.shopify.com/s/files/1/0496/2251/5865/files/cual_es_la_oracin_que_resume_nuestra_fe.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• uploads.strikinglycdn.com
• files.geekygiftbaskets.com
• bewukare.laidlawlandscape.com
• murexixig.davidschagun.com
• xasiwe.elizabethmallia.com
• files.domesticdivapropertymanagement.com
• vowaw.traversebaygroup.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report