SUSPICIOUS — 96615552599.pdf

SUSPICIOUS — 96615552599.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 58026b4eeb82f4e5a08eef545173e3c49e60b14e5d8bad31fe82162d6c9bd09b
• SHA-1: b2c9262c545f3c69a32696e471e50ac10af5484e
• MD5: db5c53fbabdc823433bfbdf1a2f87427
• ssdeep: 768:TgGzpDrKeX88hr9YDD8nRLCYYdDt8+sL0R2kn4L/JFF60jyRUDPOUouW:sGFXK0/rIARwNzBEJOi2UouW
• TLSH: T1ED329DF361A7DD4C7683EB075DEA145A904AEA8C6532A2A811C87B3DC0BC3BD2F51D11
• Submitted as: 96615552599.pdf
• File type: pdf · Size: 44085 bytes
• Verdict: suspicious (44/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=academic+cv+template+pdf, https://site-1037193.mozfiles.com/files/1037193/bupew.pdf, https://site-1036874.mozfiles.com/files/1036874/21873873939.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/strik?keyword=academic+cv+template+pdf
• https://site-1037193.mozfiles.com/files/1037193/bupew.pdf
• https://site-1036874.mozfiles.com/files/1036874/21873873939.pdf
• https://site-1036821.mozfiles.com/files/1036821/zebofokexifip.pdf
• http://vixem.brainleakage.com/uploads/1/3/0/7/130738970/98d1126d6eef.pdf
• http://xutup.jbohistory.com/uploads/1/3/1/6/131606111/pewilegu_rixerifitef_pedatenam.pdf
• http://zajase.flowcounselling.com.au/uploads/1/3/0/8/130874642/xemap_gemufen.pdf
• http://xomixoj.metastaticallyspeaking.com/uploads/1/3/2/6/132682905/aec47.pdf
• http://files.twinlakecottages.com/uploads/1/3/0/9/130970004/talozotomived.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/wizivudid.pdf
• https://cdn.shopify.com/s/files/1/0431/1279/2225/files/word_contract_template.pdf
• https://cdn.shopify.com/s/files/1/0433/8994/3971/files/sapphire_ati_radeon_hd_5450_driver.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• site-1037193.mozfiles.com
• site-1036874.mozfiles.com
• site-1036821.mozfiles.com
• vixem.brainleakage.com
• xutup.jbohistory.com
• zajase.flowcounselling.com.au
• xomixoj.metastaticallyspeaking.com
• files.twinlakecottages.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report