SUSPICIOUS — 72034772147.pdf

SUSPICIOUS — 72034772147.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 6c7a593426f683a5488afbc0377b6a852d0fffd4f642df015f2704c061c1e608
• SHA-1: 027e2d36c772f1205373b02ce70216ed6b663c2a
• MD5: 51d30dd2a099cce96402c403a78e948e
• ssdeep: 768:ogGzpDQdyGSMAnkGWlbcTYd6ZQLwv0nT0T73OwIOXnK5NG9/Mqr9r:lGFsdyATaTvv0nK73OoK5NqMqr9r
• TLSH: T1B132AFF3509BED4C6A8B9F037EAA1049718AC78C713297A448C8762CD87C7FD6D51A21
• Submitted as: 72034772147.pdf
• File type: pdf · Size: 43639 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=temperature+and+enzyme+activity+worksheet+answer+key, http://senisiduv.writerswhorun.com/uploads/1/3/1/6/131637372/gubob.pdf, http://files.prabeer.org/uploads/1/3/0/7/130740158/38bd36c41.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=temperature+and+enzyme+activity+worksheet+answer+key
• http://senisiduv.writerswhorun.com/uploads/1/3/1/6/131637372/gubob.pdf
• http://files.prabeer.org/uploads/1/3/0/7/130740158/38bd36c41.pdf
• http://files.green-runners.com/uploads/1/3/0/7/130776002/969553.pdf
• http://gotufada.gryffecreative.co.uk/uploads/1/3/0/8/130814469/xijovobusaziliw-lamajemet.pdf
• http://negifem.kineticscientific.com/uploads/1/3/1/4/131437462/pakolisunepudolusib.pdf
• http://files.humandevelopmentzone.com/uploads/1/3/1/3/131383543/d53684e0.pdf
• http://wusaju.kva27.ca/uploads/1/3/0/7/130739240/9256937.pdf
• https://site-1038803.mozfiles.com/files/1038803/ranezadakilitebuwufaf.pdf
• https://site-1037903.mozfiles.com/files/1037903/pevubupejezamuji.pdf
• https://site-1037266.mozfiles.com/files/1037266/80580407609.pdf
• https://cdn.shopify.com/s/files/1/0484/9854/0699/files/rheem_rgph-10ebrjr_manual.pdf
• https://cdn.shopify.com/s/files/1/0266/9661/4068/files/walch_integrated_math_2_textbook.pdf
• https://cdn.shopify.com/s/files/1/0479/2945/8852/files/michael_crichton_lost_world.pdf
• https://cdn.shopify.com/s/files/1/0434/3093/6733/files/burijatik.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• senisiduv.writerswhorun.com
• files.prabeer.org
• files.green-runners.com
• gotufada.gryffecreative.co.uk
• negifem.kineticscientific.com
• files.humandevelopmentzone.com
• wusaju.kva27.ca
• site-1038803.mozfiles.com
• site-1037903.mozfiles.com
• site-1037266.mozfiles.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report