SUSPICIOUS — terraforming_mars_card_template.pdf

SUSPICIOUS — terraforming_mars_card_template.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 5f9a3cff4a8b1a61e5815afb1638b2b0156061962bf43af01dd86f0eaa711020
• SHA-1: ae9d761c950947bbb48073fd809bfe691a872628
• MD5: 4db8b7c275d3ab1b42a325c853a35ece
• ssdeep: 1536:nGFlpOWabDAE6Ldy4ebCZja1Zj0Y2gLBKo/Qxc:GFlpOWanAE6M4eeZGPB2IIo/f
• TLSH: T1BD34B0F3207BEC4D7A8BAB13AA970079B149C78C6132966054C8372DD8BC5ED7F04A65
• Submitted as: terraforming_mars_card_template.pdf
• File type: pdf · Size: 55064 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=terraforming+mars+card+template, https://cdn.shopify.com/s/files/1/0435/5417/7185/files/ctevt_question_bank.pdf, https://cdn.shopify.com/s/files/1/0497/4664/1060/files/slow_cooker_walmart_price.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=terraforming+mars+card+template
• https://cdn.shopify.com/s/files/1/0435/5417/7185/files/ctevt_question_bank.pdf
• https://cdn.shopify.com/s/files/1/0497/4664/1060/files/slow_cooker_walmart_price.pdf
• https://cdn.shopify.com/s/files/1/0502/5746/1440/files/gogibud.pdf
• https://cdn.shopify.com/s/files/1/0483/9191/3624/files/cc_automotive_augusta_georgia.pdf
• https://cdn.shopify.com/s/files/1/0495/7208/5926/files/bipatexitu.pdf
• https://vodiwisilob.weebly.com/uploads/1/3/2/6/132681054/c5ccb9.pdf
• https://cdn.shopify.com/s/files/1/0434/4178/2946/files/lidonifodetivaj.pdf
• https://cdn.shopify.com/s/files/1/0499/5176/8731/files/katilovasudenokiziniridin.pdf
• https://cdn.shopify.com/s/files/1/0485/9451/8181/files/kentucky_wesleyan_football_schedule.pdf
• https://cdn-cms.f-static.net/uploads/4366007/normal_5f8d9b3cdcc92.pdf
• https://cdn-cms.f-static.net/uploads/4381735/normal_5f8dfa38963e9.pdf
• https://cdn-cms.f-static.net/uploads/4373271/normal_5f8b92ba2e66b.pdf
• https://cdn.shopify.com/s/files/1/0433/8148/9818/files/64882039312.pdf
• https://cdn.shopify.com/s/files/1/0266/8068/8819/files/baggage_tv_show_couples_still_together.pdf
• https://cdn.shopify.com/s/files/1/0494/2230/3399/files/swtor_sith_warrior_vengeance_guide.pdf
• https://s3.amazonaws.com/leguvefu/2965745261.pdf
• https://s3.amazonaws.com/kavitokolezub/zafitujelovesujetoj.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• cdn.shopify.com
• vodiwisilob.weebly.com
• cdn-cms.f-static.net
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report