SUSPICIOUS — dapetowexamefisovelud.pdf

SUSPICIOUS — dapetowexamefisovelud.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 7e293ab348dfa2434e862ace01b69c8685e54116d20da93c949def3b4b45e752
• SHA-1: 2f00ae5530c94d46faaf432c808f9bf90cd5b58c
• MD5: d0a9100445f70ab9e515cda533ea4d69
• ssdeep: 768:bgGzpDzge4S4NxKchODmjp8PmckeqmI5nhevSTPF/vYsr9JbVPQ9DaC:kGFn70p8PmckeqmSnheKTNgEbVY5l
• TLSH: T146319DF31097EC8C3B8BAB0799FA114DA24AC7886033D7A015DD7A6CC47C6BD2E01965
• Submitted as: dapetowexamefisovelud.pdf
• File type: pdf · Size: 40942 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=anatomy+of+coronary+arteries+pdf, https://cdn.shopify.com/s/files/1/0439/4654/1211/files/basic_automobile_engineering_book_free_download.pdf, https://cdn.shopify.com/s/files/1/0430/0649/2823/files/brown_bunny_bj.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/strik?keyword=anatomy+of+coronary+arteries+pdf
• https://cdn.shopify.com/s/files/1/0439/4654/1211/files/basic_automobile_engineering_book_free_download.pdf
• https://cdn.shopify.com/s/files/1/0430/0649/2823/files/brown_bunny_bj.pdf
• https://cdn.shopify.com/s/files/1/0435/5565/1743/files/pearson_readygen_teacher_guide_kinde.pdf
• https://cdn.shopify.com/s/files/1/0462/0232/3094/files/avast_antivirus_2020_free_offline_download.pdf
• https://cdn.shopify.com/s/files/1/0428/8138/4604/files/xajevodad.pdf
• http://files.karlrichardolsen.com/uploads/1/3/1/6/131636828/1068554.pdf
• http://files.oaklandriversidegolfcourse.com/uploads/1/3/2/6/132680901/lonisejaviwaleloba.pdf
• https://cdn.shopify.com/s/files/1/0432/8390/6724/files/brazilian_jiu_jitsu_beginners_guide.pdf
• https://cdn.shopify.com/s/files/1/0430/0803/2922/files/89082672835.pdf
• https://cdn.shopify.com/s/files/1/0435/8248/8733/files/best_ebook_reader_android.pdf
• http://doxenuwa.tjmemorialfund.org/uploads/1/3/2/7/132740280/092e6391eabe.pdf
• http://files.kelownaplumbingsolutions.com/uploads/1/3/1/3/131398156/vudejinu-kedav-benosagulita.pdf
• http://files.thomasbrowndiscos.co.uk/uploads/1/3/1/4/131407395/nefinito_vemikikagaj_kanugonijejufi_bazemug.pdf
• http://ratuz.companychowfoodjunkies.net/uploads/1/3/0/7/130775318/magoxudul-gakuta-zutegowebiruv-latena.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• cdn.shopify.com
• files.karlrichardolsen.com
• files.oaklandriversidegolfcourse.com
• doxenuwa.tjmemorialfund.org
• files.kelownaplumbingsolutions.com
• files.thomasbrowndiscos.co.uk
• ratuz.companychowfoodjunkies.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report