SUSPICIOUS — sevirojus.pdf

SUSPICIOUS — sevirojus.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: a8e305358dd17d001281374d105d41e8e0ca572dc1358288b96fa7af42e72eee
• SHA-1: 047df9ffb98ea6209eb3a7a4163c2152fdc39709
• MD5: 594c06555e47ac519b0bf3b94c18fb23
• ssdeep: 1536:BGFuK2tqAa/2WCezeb5CuR5WEWWPRkOE0J8jxRmmY:kFuK2tvMuezeb5dR5FWWPiOE0J8jr6
• TLSH: T10835CFF3616BDD8D36C79B07AC69062AA145C78670636770598C2B7C887C3FCBE40662
• Submitted as: sevirojus.pdf
• File type: pdf · Size: 60911 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/wb?keyword=macro%20code%20for%20excel%20to%20pdf, https://cdn-cms.f-static.net/uploads/4365661/normal_5f871435b4e47.pdf, https://cdn-cms.f-static.net/uploads/4365652/normal_5f87212487283.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/wb?keyword=macro%20code%20for%20excel%20to%20pdf
• https://cdn-cms.f-static.net/uploads/4365661/normal_5f871435b4e47.pdf
• https://s3.amazonaws.com/temujonuwu/nowutajelevubisa.pdf
• https://s3.amazonaws.com/pukiza/slewing_bearing_skf.pdf
• https://s3.amazonaws.com/zafaronivaj/velivavanaxikizaxefanabu.pdf
• https://s3.amazonaws.com/gumagabu/descargar_libro_after_2_gratis_completo.pdf
• https://s3.amazonaws.com/vonuxagupeduze/39575642222.pdf
• https://cdn-cms.f-static.net/uploads/4365652/normal_5f87212487283.pdf
• https://s3.amazonaws.com/jovekus/2057001152.pdf
• https://s3.amazonaws.com/subud/hau_bsc_agriculture_entrance_exam_question_papers.pdf
• https://cdn-cms.f-static.net/uploads/4380219/normal_5f92edfc5371a.pdf
• https://s3.amazonaws.com/lezopobigeza/49647058807.pdf
• https://s3.amazonaws.com/zirojopemup/arsenic_pollution.pdf
• https://s3.amazonaws.com/sizadagazagaj/69529804954.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• cdn-cms.f-static.net
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report