SUSPICIOUS — 89764660576.pdf
SUSPICIOUS — 89764660576.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
bda7924789bb7bd3cf01e815b9e3db01c4d6b741d32e1d7d4385593f581abd01 - SHA-1:
67664b344a40ced5534eeea2133f9e57198ec514 - MD5:
71bd02b9bf2ea0863bb541d7f22c5fa4 - ssdeep:
768:0gGzpDrpjBJwM4WIX4ckMvYKlVkmtmCLKU+jCVz:BGFfpjoWIXRHvY0VkQ9LT+OVz - TLSH:
T10630BFF7509BEC5C3A8ABB07AEE500161156C3886123D7A049C9773C98BC7BDBE11CA1 - Submitted as: 89764660576.pdf
- File type: pdf · Size: 38521 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=kitchenaid+induction+cooktop+instruction+manual, https://uploads.strikinglycdn.com/files/9cd64cb3-a785-4807-b807-c823500bda2c/74917632742.pdf, https://uploads.strikinglycdn.com/files/5d1708cf-289d-4571-a33c-4f888bad25a4/26184821279.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/strik?keyword=kitchenaid+induction+cooktop+instruction+manual
- https://uploads.strikinglycdn.com/files/9cd64cb3-a785-4807-b807-c823500bda2c/74917632742.pdf
- https://uploads.strikinglycdn.com/files/5d1708cf-289d-4571-a33c-4f888bad25a4/26184821279.pdf
- https://uploads.strikinglycdn.com/files/bb2d881b-e54f-4bf8-9b67-ae125929160f/sufikudagapobujigazukowu.pdf
- https://uploads.strikinglycdn.com/files/2cce8c51-0104-4d0e-bc58-6888a2e0693f/31641199042.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/665612.pdf
- https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/3718456.pdf
- https://uploads.strikinglycdn.com/files/d812b2c4-b342-459a-971a-a87daaf8cc8a/venazar.pdf
- https://uploads.strikinglycdn.com/files/b74ccbaf-7a39-4ffc-98bb-390bccac5f81/14930690939.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- dutitujazekap.weebly.com
- jakedekokobara.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report