SUSPICIOUS — 27765770350.pdf

SUSPICIOUS — 27765770350.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 82284f76ecd7c2d6f020962513e6e7b46afea1762c862df0d62939b402540d61
• SHA-1: 0a5d9cfd279adca14d696f928c5919c9cf554fe9
• MD5: f93aa2ad62441f199ed8b3f29f0d0c28
• ssdeep: 1536:oGF3p8SUL0HgHLt1KwpZXdpMy88vWXDFy:FF3p8SHHgHLt4wFpMfAWXM
• TLSH: T16F33BFF31067EE8CB98BAB83BEA611051145DA8D7133DA605C897B2CC47C6FDAF40A51
• Submitted as: 27765770350.pdf
• File type: pdf · Size: 52110 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=mejores+libros+de+biologia+celular, http://files.stanalexander.com/uploads/1/3/1/6/131606890/4682475.pdf, http://tosewaw.eventsforyou.net/uploads/1/3/1/6/131637306/3233535.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=mejores+libros+de+biologia+celular
• http://files.stanalexander.com/uploads/1/3/1/6/131606890/4682475.pdf
• http://tosewaw.eventsforyou.net/uploads/1/3/1/6/131637306/3233535.pdf
• http://fidizoja.warriorfitnessclub.com/uploads/1/3/1/4/131438563/wagivok.pdf
• http://files.bethanyhomestead.co.uk/uploads/1/3/1/4/131406563/aa7be.pdf
• http://vulub.pjmventures.com/uploads/1/3/2/6/132682076/ninizal_jevux.pdf
• http://files.zopaart.com/uploads/1/3/0/9/130969717/reguviz-pojek.pdf
• http://bomek.joeystupor.com/uploads/1/3/1/3/131398164/rigejawof.pdf
• http://files.echizen32k.com/uploads/1/3/1/3/131383283/rakanavesesegizev.pdf
• https://cdn.shopify.com/s/files/1/0439/8042/3326/files/until_they_bring_the_streetcars_back_characters.pdf
• https://cdn.shopify.com/s/files/1/0482/0104/0024/files/tom_clancys_rainbow_six_siege_phantom_sight_release_date.pdf
• https://cdn.shopify.com/s/files/1/0481/9802/5373/files/voltage_gated_sodium_channel.pdf
• https://uploads.strikinglycdn.com/files/fb4aed48-6e79-4fce-8bd4-ba633d81aa6e/80762714717.pdf
• https://uploads.strikinglycdn.com/files/f82bef66-b0f9-4729-95d1-69627315dfb9/dekirigolejimixig.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• files.stanalexander.com
• tosewaw.eventsforyou.net
• fidizoja.warriorfitnessclub.com
• files.bethanyhomestead.co.uk
• vulub.pjmventures.com
• files.zopaart.com
• bomek.joeystupor.com
• files.echizen32k.com
• cdn.shopify.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report