SUSPICIOUS — 91755714071.pdf

SUSPICIOUS — 91755714071.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: b28da796a2f127de5ca2f66c1e50a7103b7b4f48be858007d9e26bfb2573fd3d
• SHA-1: 66292986daf98b1075b8adc480bbae3e90f31b3b
• MD5: 5dcbb47ba9c02c13b7364a511d5bced5
• ssdeep: 768:GgGzpDlw+ihmDeq5fuBrG9SzV/xi9TcAdLM0YaecIuvvQlFez1:TGFJ2G9S989TcAxj5+unQlFez1
• TLSH: T10C32AEF3554BDC8D6A869B07ADAA20449146C38CA232EB7055CC7B7CD47C2FCAE50E60
• Submitted as: 91755714071.pdf
• File type: pdf · Size: 45361 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=nightwatch+astronomy+book+pdf, https://site-1036807.mozfiles.com/files/1036807/mamevup.pdf, https://site-1036636.mozfiles.com/files/1036636/fifomevutuwulolit.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/strik?keyword=nightwatch+astronomy+book+pdf
• https://site-1036807.mozfiles.com/files/1036807/mamevup.pdf
• https://site-1036636.mozfiles.com/files/1036636/fifomevutuwulolit.pdf
• https://site-1036692.mozfiles.com/files/1036692/darobelowita.pdf
• https://site-1036637.mozfiles.com/files/1036637/37568878124.pdf
• https://uploads.strikinglycdn.com/files/e46f09f8-8323-4060-906a-5363c72d7b1a/bibugezupigabi.pdf
• https://cdn.shopify.com/s/files/1/0463/0570/6144/files/bringing_home_a_baby_bumblebee_sheet_music.pdf
• https://cdn.shopify.com/s/files/1/0431/2799/6565/files/83571164260.pdf
• https://cdn.shopify.com/s/files/1/0429/6795/7660/files/vemafibatage.pdf
• https://cdn.shopify.com/s/files/1/0432/1030/9787/files/92613446535.pdf
• https://cdn.shopify.com/s/files/1/0434/6540/8662/files/basic_confidentiality_agreement_template_free.pdf
• https://site-1036786.mozfiles.com/files/1036786/kazimar.pdf
• https://site-1037130.mozfiles.com/files/1037130/72343141250.pdf
• https://site-1036713.mozfiles.com/files/1036713/wiroz.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• site-1036807.mozfiles.com
• site-1036636.mozfiles.com
• site-1036692.mozfiles.com
• site-1036637.mozfiles.com
• uploads.strikinglycdn.com
• cdn.shopify.com
• site-1036786.mozfiles.com
• site-1037130.mozfiles.com
• site-1036713.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report