SUSPICIOUS — varasi.pdf

SUSPICIOUS — varasi.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: a68de7519d65068b403966c0b8fa9eb3bc1d6721137815ebada82a4a3e752e52
• SHA-1: 941a8af3db569e239c8802173dbc568cc67bf402
• MD5: c609dbeb76ef04284b8c8549052a0933
• ssdeep: 768:JgGzpDKztxmMjdSuO5vka6MF8JGtco2zm+M+q:qGFUtFjAlMNo8J8cBzm+M+q
• TLSH: T1ED318DF35167DC8C7A8BAB07AEE610586109D38CB136A6B084887B7C847C6FD2F51A51
• Submitted as: varasi.pdf
• File type: pdf · Size: 39638 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=avchd+preset+premiere+pro+cs6, http://files.the-vintage-villa.com/uploads/1/3/1/3/131379578/garotese-nawuretog-jofetezonuv-zepugela.pdf, http://mosim.relationalintegration.org/uploads/1/3/1/3/131398404/3a2cb4e05f.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=avchd+preset+premiere+pro+cs6
• http://files.the-vintage-villa.com/uploads/1/3/1/3/131379578/garotese-nawuretog-jofetezonuv-zepugela.pdf
• http://mosim.relationalintegration.org/uploads/1/3/1/3/131398404/3a2cb4e05f.pdf
• http://files.gfx-pro.net/uploads/1/3/2/7/132710795/wunologorosapapaze.pdf
• http://tapemewof.miwwi.us/uploads/1/3/0/8/130874600/tuwusadoveredon-nikozibasave.pdf
• https://site-1038774.mozfiles.com/files/1038774/11843542762.pdf
• https://site-1037057.mozfiles.com/files/1037057/10842250634.pdf
• https://uploads.strikinglycdn.com/files/49818109-9102-46ba-aa8a-446c9b45af97/jeradas.pdf
• https://uploads.strikinglycdn.com/files/f7dc5be3-fd35-40fe-a2a3-1f404a463ec6/fajujago.pdf
• https://uploads.strikinglycdn.com/files/95bd9b8a-e9dd-4f99-ad98-9d35ba7c702d/juweravosekodazikitetuwo.pdf
• https://uploads.strikinglycdn.com/files/3e917c4b-c6f0-4843-aaaa-f9d51f64b714/diramomigajerotabuvino.pdf
• https://site-1037026.mozfiles.com/files/1037026/10590280912.pdf
• https://site-1040609.mozfiles.com/files/1040609/fafopevuburogadan.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• files.the-vintage-villa.com
• mosim.relationalintegration.org
• files.gfx-pro.net
• tapemewof.miwwi.us
• site-1038774.mozfiles.com
• site-1037057.mozfiles.com
• uploads.strikinglycdn.com
• site-1037026.mozfiles.com
• site-1040609.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report