SUSPICIOUS — 58716223333.pdf

SUSPICIOUS — 58716223333.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: b5fa9127ffc3b7808218526b678d08f791f3607fb2d8208226062e3f93c72f85
• SHA-1: 6202636589d3277a657506d04807a85ffd4498b5
• MD5: 9d1ffe30f274bab7d658f076af534671
• ssdeep: 768:9gGzpDq1yPoEOdkE+rK4UUuCAg0LmTjE8I/zMUjP5E4mGsta40H1:+GFO1yI+rfuLNLmTj8/oUjxE4mGstn0V
• TLSH: T17E329FF32097EC8C7BC69B03A9AB006D7547D689613367645988B77CC8BC2FD6E00951
• Submitted as: 58716223333.pdf
• File type: pdf · Size: 47153 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=clicker+heroes+clan, http://files.burninguptheroad.com/uploads/1/3/0/8/130815437/b8e4d2a228f400a.pdf, http://files.alanleesartist.com/uploads/1/3/0/9/130969402/xubomakuvosago_kibewebiw.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=clicker+heroes+clan
• http://files.burninguptheroad.com/uploads/1/3/0/8/130815437/b8e4d2a228f400a.pdf
• http://files.alanleesartist.com/uploads/1/3/0/9/130969402/xubomakuvosago_kibewebiw.pdf
• http://taxet.bellagio-at-home.net/uploads/1/3/2/3/132303195/lafufugunadi.pdf
• http://lumujubu.edeio.org/uploads/1/3/1/6/131636725/c2ebfd232.pdf
• http://najolebev.icomppower.com/uploads/1/3/0/9/130969077/45433311ed.pdf
• http://mofiwezi.rhlab.org/uploads/1/3/2/6/132681734/xutora.pdf
• http://lobigow.elleavivnewton.com/uploads/1/3/1/3/131384055/e506ae.pdf
• http://files.gobigt.com/uploads/1/3/1/1/131164112/7648220.pdf
• https://uploads.strikinglycdn.com/files/574631ff-f685-4419-b4a8-fb21f8b42527/12248898087.pdf
• https://uploads.strikinglycdn.com/files/b94e1ea8-6d0e-4d47-b51a-cebe7c62fd43/57909464068.pdf
• http://satarome.rosytoesdesigns.com/uploads/1/3/1/4/131437778/8fdcdf8.pdf
• http://files.wildtales.blog/uploads/1/3/2/6/132681337/vumijitegukutalufedu.pdf
• http://files.pixelleadershipgroup.com/uploads/1/3/2/3/132302883/1992943.pdf
• http://bumibezo.nejcrwc.com/uploads/1/3/0/7/130739235/kamikifo.pdf
• http://files.buyportlandstores.com/uploads/1/3/0/9/130969316/4d7a2aba146cfe.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• files.burninguptheroad.com
• files.alanleesartist.com
• taxet.bellagio-at-home.net
• lumujubu.edeio.org
• najolebev.icomppower.com
• mofiwezi.rhlab.org
• lobigow.elleavivnewton.com
• files.gobigt.com
• uploads.strikinglycdn.com
• satarome.rosytoesdesigns.com
• files.pixelleadershipgroup.com
• bumibezo.nejcrwc.com
• files.buyportlandstores.com
• www.w3.org
• purl.org
• ns.adobe.com
• files.wildtales.blog

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report