SUSPICIOUS — 35389174657.pdf
SUSPICIOUS — 35389174657.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
8aa7a813a7fc0b9055a34b02189a5c7f6cbc0a11be721bb44d675f15c2dd3410 - SHA-1:
c1691394d3bb33e775cf76d02fabdf8678f089c0 - MD5:
4bccd9fe58dfa594c8487b71f2b0daa7 - ssdeep:
768:GgGzpDdvr0c7aF1+TLGDyNP9mkEROR2gPFTEkPWsNvhqe:TGFBTrLejROsgFPWEhqe - TLSH:
T16032BEF3916BED8C7A8A6B07AEB710885485C78C7032F6A016D87B2DC47C6BD6F04915 - Submitted as: 35389174657.pdf
- File type: pdf · Size: 46443 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=ielts+reading+passage+the+arthritis, https://site-1040346.mozfiles.com/files/1040346/kutuvo.pdf, https://site-1044104.mozfiles.com/files/1044104/63455608842.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://ggtraff.ru/strik?keyword=ielts+reading+passage+the+arthritis
- https://site-1040346.mozfiles.com/files/1040346/kutuvo.pdf
- https://site-1044104.mozfiles.com/files/1044104/63455608842.pdf
- https://site-1039837.mozfiles.com/files/1039837/zeruxufuvavaza.pdf
- https://site-1043559.mozfiles.com/files/1043559/bijokemuzakale.pdf
- https://site-1037237.mozfiles.com/files/1037237/87321524455.pdf
- http://fapet.latorreholidays.com/uploads/1/3/0/8/130874493/forej-luturonimi.pdf
- http://files.dreamweaversct.com/uploads/1/3/0/7/130740524/xupenafanoxov.pdf
- http://files.marrymeindonegal.com/uploads/1/3/1/4/131437487/f6491133.pdf
- https://site-1037178.mozfiles.com/files/1037178/dedoniv.pdf
- https://site-1041169.mozfiles.com/files/1041169/pipupapizunotoko.pdf
- http://files.rover800.club/uploads/1/3/1/3/131384359/bf52c7383e.pdf
- http://files.middleagemiracles.com/uploads/1/3/0/8/130814584/wipoten.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- site-1040346.mozfiles.com
- site-1044104.mozfiles.com
- site-1039837.mozfiles.com
- site-1043559.mozfiles.com
- site-1037237.mozfiles.com
- fapet.latorreholidays.com
- files.dreamweaversct.com
- files.marrymeindonegal.com
- site-1037178.mozfiles.com
- site-1041169.mozfiles.com
- files.rover800.club
- files.middleagemiracles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report