SUSPICIOUS — gekusije.pdf
SUSPICIOUS — gekusije.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
773908c961dcdb4e958f5d48b2640940abbf707ff9a9ee2f19e0b35dd565421d - SHA-1:
d586a4aa101819e01369c7a39fa89d1a37702ce8 - MD5:
a83160845c7c830d99167ebfe5ce4a54 - ssdeep:
768:2gGzpDEUA3Xl3S68pIJ6DyMthlpVh6dMgH9o39RWas2hip4/iAZd4KxvKBssVVgn:jGF//Rhip4qwS+vKBskVgbT - TLSH:
T19732AFF35097FC8D7A87DB137DEA105A558DC388A032E661598C362CE5BCABE7D10821 - Submitted as: gekusije.pdf
- File type: pdf · Size: 43744 bytes
- Verdict: suspicious (44/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/wb?keyword=karnataka%20rto%20registration%20numbers%20list%20pdf, https://cdn.shopify.com/s/files/1/0434/5007/3240/files/dragon_quest_8.pdf, https://cdn.shopify.com/s/files/1/0483/8640/8597/files/red_wing_lineman_boots_4417.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/wb?keyword=karnataka%20rto%20registration%20numbers%20list%20pdf
- https://cdn.shopify.com/s/files/1/0434/5007/3240/files/dragon_quest_8.pdf
- https://cdn.shopify.com/s/files/1/0483/8640/8597/files/red_wing_lineman_boots_4417.pdf
- https://cdn.shopify.com/s/files/1/0506/5329/8838/files/dengue_fever_cdc_guidelines.pdf
- https://cdn.shopify.com/s/files/1/0438/6249/1286/files/acr_2020_gout_guidelines.pdf
- https://cdn.shopify.com/s/files/1/0504/0147/6758/files/italy_travel_guide.pdf
- https://cdn.shopify.com/s/files/1/0476/6810/1286/files/baparotutuzemita.pdf
- https://cdn.shopify.com/s/files/1/0467/7727/0425/files/denaxakukuren.pdf
- https://cdn.shopify.com/s/files/1/0497/2360/5153/files/tozuje.pdf
- https://cdn.shopify.com/s/files/1/0504/0852/1902/files/96490171570.pdf
- https://cdn.shopify.com/s/files/1/0503/6133/5995/files/convertir_un_document_en_powerpoint_gratuit.pdf
- https://cdn.shopify.com/s/files/1/0441/1945/7944/files/exterior_angles_of_triangles_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0268/8234/3103/files/79708877210.pdf
- https://cdn.shopify.com/s/files/1/0501/7046/2373/files/eventide_h9_control_app_manual.pdf
- https://cdn.shopify.com/s/files/1/0266/9238/6999/files/free_conjunction_worksheets_for_1st_grade.pdf
- https://cdn-cms.f-static.net/uploads/4392667/normal_5f94339d24f58.pdf
- https://cdn.shopify.com/s/files/1/0500/9057/3987/files/descargar_tubemate_2020_para_android.pdf
- https://cdn.shopify.com/s/files/1/0427/8861/8396/files/64615727783.pdf
- https://cdn.shopify.com/s/files/1/0495/9902/1219/files/texelepi.pdf
- https://cdn.shopify.com/s/files/1/0501/3353/2837/files/bujabivefefozel.pdf
- https://cdn.shopify.com/s/files/1/0493/1973/9551/files/hairspray_2020_movie_script.pdf
- https://cdn.shopify.com/s/files/1/0505/0748/1258/files/bed_bath_and_beyond_instant_pot_accessories.pdf
- https://cdn-cms.f-static.net/uploads/4366009/normal_5f8ef33589933.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- cctraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report