SUSPICIOUS — 89175238790.pdf

SUSPICIOUS — 89175238790.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 645974aa32ba6c9fdeb01b277484a8364cf8fcb5183e8868e8d64ea404e4efb8
• SHA-1: 31e4140097ff4b72fe400de01cc3b1e4e3a48a03
• MD5: 1180478336277a07fec43739176d7b8a
• ssdeep: 768:/gGzpDCWFkLwwFfH7t1aYkzx/+dgEOWSryJ05S4zWyg:IGFeWKjxWGKWSr5Q4zng
• TLSH: T171329EF39153ED8C768BAB036DFA105A624AC78DB135CA5050CC662DD0BC2FDAE50A60
• Submitted as: 89175238790.pdf
• File type: pdf · Size: 44167 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=alice+in+wonderland+play+yard, http://files.metalmeltdown.com/uploads/1/3/0/7/130775755/36f932b68a.pdf, http://files.yalechildrenstheater.org/uploads/1/3/0/7/130775172/46f68412be3c68f.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=alice+in+wonderland+play+yard
• http://files.metalmeltdown.com/uploads/1/3/0/7/130775755/36f932b68a.pdf
• http://files.yalechildrenstheater.org/uploads/1/3/0/7/130775172/46f68412be3c68f.pdf
• http://files.lucianamagdalena.com/uploads/1/3/1/4/131454046/xafalizituda.pdf
• http://katonoke.habbofis.com/uploads/1/3/1/6/131607163/89032c.pdf
• http://files.sarahtrignano.com/uploads/1/3/0/7/130775304/6efa3c94873.pdf
• https://site-1036926.mozfiles.com/files/1036926/75475097174.pdf
• https://site-1036737.mozfiles.com/files/1036737/zapujenevemafudezav.pdf
• https://site-1038522.mozfiles.com/files/1038522/pexujofekogu.pdf
• https://cdn.shopify.com/s/files/1/0495/5232/6823/files/menolekopovixaxe.pdf
• https://cdn.shopify.com/s/files/1/0482/8846/5054/files/bollinger_on_bollinger_bands_book.pdf
• https://cdn.shopify.com/s/files/1/0435/2675/0359/files/cypress_creek_renewables_glassdoor.pdf
• https://cdn.shopify.com/s/files/1/0430/9083/7655/files/philcare_accredited_dental_clinic_in_taguig.pdf
• https://cdn.shopify.com/s/files/1/0432/7427/2924/files/2722180720.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• files.metalmeltdown.com
• files.yalechildrenstheater.org
• files.lucianamagdalena.com
• katonoke.habbofis.com
• files.sarahtrignano.com
• site-1036926.mozfiles.com
• site-1036737.mozfiles.com
• site-1038522.mozfiles.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report