SUSPICIOUS — sixolaje.pdf

SUSPICIOUS — sixolaje.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: b54cfcf3927e868825c34f2a76db4b79bf91ea8fa9e2309da71dd89c1fcde5e3
• SHA-1: 86a4e4d11799bf2412626ce9c581e1305105b89d
• MD5: 8b82eb83d352b6b4ff3c47df4f9beb3c
• ssdeep: 768:ggGzpDupYY8/fuNaRZG6eNHJGjA/MqPfNZynD28NrpqAowo3o2gk:tGFiq+aRZalJ0MNVZyni8NYY2gk
• TLSH: T1F3309EF3146BDD8C7AC6AB136AFE1059A04DC68C213797B069D87B6DD47C4BDAE00890
• Submitted as: sixolaje.pdf
• File type: pdf · Size: 39039 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=verb+tense+chart, https://uploads.strikinglycdn.com/files/53233478-83da-4974-8893-748e41514231/misudalik.pdf, https://uploads.strikinglycdn.com/files/335cc223-2d90-4ec2-8f8b-6241a985e838/53215338132.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/strik?keyword=verb+tense+chart
• https://uploads.strikinglycdn.com/files/53233478-83da-4974-8893-748e41514231/misudalik.pdf
• https://uploads.strikinglycdn.com/files/335cc223-2d90-4ec2-8f8b-6241a985e838/53215338132.pdf
• https://uploads.strikinglycdn.com/files/a475e9a4-ad10-4376-8db5-63f508302f94/29168650117.pdf
• https://uploads.strikinglycdn.com/files/04fa285e-9109-4e81-90f2-f6bf8a6067d6/zabobezozezu.pdf
• https://uploads.strikinglycdn.com/files/e7d1bb1e-606d-43b6-8a5f-f1ed4009ccfb/jafizidanedipi.pdf
• https://uploads.strikinglycdn.com/files/b2f476e5-4a17-4f19-87b1-708c8f2972d2/zawavigejusulu.pdf
• https://uploads.strikinglycdn.com/files/ccbcee7e-a623-4947-906c-9518a62db871/15883469498.pdf
• https://uploads.strikinglycdn.com/files/5885d07f-e470-47db-a5aa-9ebea4689bc5/81551859707.pdf
• https://uploads.strikinglycdn.com/files/84c78806-2e66-4284-912a-fbe1b9dcb1e5/zavimurugijatinabuzime.pdf
• https://uploads.strikinglycdn.com/files/8718d16f-467d-4b3e-972f-338e74f3f5fa/darazuxofidatoxibesiku.pdf
• https://cdn.shopify.com/s/files/1/0483/7510/3646/files/gulla_gulla_island.pdf
• https://cdn.shopify.com/s/files/1/0434/1760/0156/files/rirogimobafakugedaf.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• uploads.strikinglycdn.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report