SUSPICIOUS — 52203673975.pdf

SUSPICIOUS — 52203673975.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ba1a60b8ddb3d234300238ebdc29e49b14ca2231e698e5b6d4b1c8ef05d475b7
• SHA-1: 79338aa2b540fbdc9e123f16c840d7c4c3340399
• MD5: cbff5f13f368bfc181d38ad4a528a5fc
• ssdeep: 768:EgGzpDhNc9b2OV5Owx2O1BA9hghkWRWTon8wFx2/1kOlNyqD:xGFdLwksBAwWTon8GqNyqD
• TLSH: T14E329DF350DBEC4CBACAAF036DAA044D9146D689213797A018C8772CD4BC7FD6E14A61
• Submitted as: 52203673975.pdf
• File type: pdf · Size: 43415 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=getting+to+know+you+sheet+music+pdf, http://files.orendagametables.org/uploads/1/3/1/0/131071243/60057.pdf, http://tojowo.kaneykreative.com/uploads/1/3/1/0/131070590/rulodidigid_ditameper_puwavu_bevoxaja.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=getting+to+know+you+sheet+music+pdf
• http://files.orendagametables.org/uploads/1/3/1/0/131071243/60057.pdf
• http://tojowo.kaneykreative.com/uploads/1/3/1/0/131070590/rulodidigid_ditameper_puwavu_bevoxaja.pdf
• http://files.blackbirdecor.com/uploads/1/3/1/4/131438442/liditolunuxu-muvusup.pdf
• https://cdn.shopify.com/s/files/1/0434/0426/3585/files/zuradidonudiz.pdf
• https://cdn.shopify.com/s/files/1/0432/3164/1767/files/town_hall_7_base.pdf
• https://cdn.shopify.com/s/files/1/0485/9897/4629/files/zombicide_painting_guide.pdf
• https://cdn.shopify.com/s/files/1/0437/7165/8392/files/family_guy_jamaican_maid_meme.pdf
• https://cdn.shopify.com/s/files/1/0430/4021/1097/files/practical_electronics_for_inventors_reddit.pdf
• http://lukotavux.alfeinstein.com/uploads/1/3/1/4/131453416/batonozasegovu.pdf
• http://talamin.naturesheartlandfarm.com/uploads/1/3/1/6/131606349/tixosuliz.pdf
• https://uploads.strikinglycdn.com/files/c8c2a6e2-131c-49bc-a1af-71dfabc1911f/44542808408.pdf
• https://uploads.strikinglycdn.com/files/9ccb30a4-174c-4803-930e-d71acdc7537d/96309043541.pdf
• https://uploads.strikinglycdn.com/files/df5af0fe-c753-440d-af0b-e798fc53bc40/nulitukozidowiwedo.pdf
• https://uploads.strikinglycdn.com/files/88bd5b86-7e82-4fbf-b0f4-c05f14d7b3b2/kekokotarobakazunu.pdf
• https://uploads.strikinglycdn.com/files/d0bf7bb0-8096-435f-b03f-1262ad8b840a/64373516136.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• files.orendagametables.org
• tojowo.kaneykreative.com
• files.blackbirdecor.com
• cdn.shopify.com
• lukotavux.alfeinstein.com
• talamin.naturesheartlandfarm.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report