SUSPICIOUS — xuzixididovifotezo.pdf

SUSPICIOUS — xuzixididovifotezo.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: a89b088d30a1dcfc37e740f538685e76a4a28beb940a4d1ad0661f8474e0fdda
• SHA-1: 52dfd06d8d879389de74b4e475aeaf7bb6d47b49
• MD5: e541fe9ca43afcedf496e0ed91769a47
• ssdeep: 768:OgGzpDKpcoOAxE+zJzjXqCmlVF5IyBIVn57TGdi9OxF46WDpXL:rGFOpcITmlV/IyBOhTGfF46WD5L
• TLSH: T16F328DF35067EE8CBA8B9F876DAB058A604AD789216397A40588372CC47C5ED7F10631
• Submitted as: xuzixididovifotezo.pdf
• File type: pdf · Size: 44908 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=como+curar+las+grietas+del+pezon, https://cdn.shopify.com/s/files/1/0432/0070/8765/files/77993017606.pdf, https://cdn.shopify.com/s/files/1/0500/3191/9254/files/the_herons_nest_tourist_suite.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=como+curar+las+grietas+del+pezon
• https://s3.amazonaws.com/wonoti/37037835112.pdf
• https://s3.amazonaws.com/tadovu/93192294739.pdf
• https://s3.amazonaws.com/jamokaroxoj/bugepejatarerutipenavor.pdf
• https://s3.amazonaws.com/subud/2668809516.pdf
• https://s3.amazonaws.com/henghuili-files/32134605111.pdf
• https://cdn.shopify.com/s/files/1/0432/0070/8765/files/77993017606.pdf
• https://cdn.shopify.com/s/files/1/0500/3191/9254/files/the_herons_nest_tourist_suite.pdf
• https://cdn.shopify.com/s/files/1/0462/3876/1109/files/zepaloparu.pdf
• https://cdn.shopify.com/s/files/1/0480/8808/8728/files/ashara_zavros_romance_guide.pdf
• https://s3.amazonaws.com/pazifetanegapu/98493081771.pdf
• https://s3.amazonaws.com/jamokaroxoj/97277635119.pdf
• https://s3.amazonaws.com/sugaguxagu/55151798573.pdf
• https://s3.amazonaws.com/sugaguxagu/tuximewojabedafojivarofi.pdf
• https://s3.amazonaws.com/wilugugo/74876455132.pdf
• https://s3.amazonaws.com/felasorarabipis/25936715993.pdf
• https://s3.amazonaws.com/zuxadol/gitofijavovorevujosovobos.pdf
• https://tarirubawapub.weebly.com/uploads/1/3/1/6/131606173/dipipob.pdf
• https://junoxavod.weebly.com/uploads/1/3/1/3/131384771/parak-xagolabik-gijixobugipip.pdf
• https://cdn-cms.f-static.net/uploads/4366043/normal_5f86f8937d2ea.pdf
• https://cdn-cms.f-static.net/uploads/4366348/normal_5f87561a29867.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• ggtraff.ru
• s3.amazonaws.com
• cdn.shopify.com
• tarirubawapub.weebly.com
• junoxavod.weebly.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report