SUSPICIOUS — susub.pdf
SUSPICIOUS — susub.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
bdcd26dfb7f494fc0b0d3e0f8f740cf480d5e355e469bc2738d6efaa6c4d12d4 - SHA-1:
fc1641eabf156e17fe60ded6dc46099d3a13aab3 - MD5:
18f9e8744d65661805441365dbab7c5d - ssdeep:
768:NgGzpDqxEGQIhNI4Su3CXASXPOb9X1R9GhOvx:uGFuxEGuu4xfY1vGhOvx - TLSH:
T13C329EF3509BDD8C7B8A6B035DE61099518AC78EA161D760189C7B2CC0BCAFD6F50E60 - Submitted as: susub.pdf
- File type: pdf · Size: 43720 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/strik?keyword=cardinal+and+ordinal+numbers+worksheet+pdf, http://kuvapepod.kirtanpath.com/uploads/1/3/2/6/132695278/nusazojudala_minadolidiwo.pdf, http://duburur.rmelectricsolutions.com/uploads/1/3/0/7/130739223/surajebaduxume.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/strik?keyword=cardinal+and+ordinal+numbers+worksheet+pdf
- http://kuvapepod.kirtanpath.com/uploads/1/3/2/6/132695278/nusazojudala_minadolidiwo.pdf
- http://duburur.rmelectricsolutions.com/uploads/1/3/0/7/130739223/surajebaduxume.pdf
- http://files.waltonplumbingandheating.com/uploads/1/3/2/8/132815015/9629713.pdf
- http://fomogam.flygirlfitness.com/uploads/1/3/1/1/131163935/5e9f5f51df.pdf
- https://site-1042277.mozfiles.com/files/1042277/78600860237.pdf
- https://site-1039424.mozfiles.com/files/1039424/gaduf.pdf
- https://site-1037160.mozfiles.com/files/1037160/57156643089.pdf
- https://site-1038338.mozfiles.com/files/1038338/nawumapugekudoxum.pdf
- https://site-1041372.mozfiles.com/files/1041372/nazetopagejirelavin.pdf
- https://uploads.strikinglycdn.com/files/c199a903-34a7-4829-aaac-de6632571fc1/gorijas.pdf
- https://uploads.strikinglycdn.com/files/5e893a6e-ce07-4b2b-89f3-aa060905f7ca/zitixanepafivakes.pdf
- https://uploads.strikinglycdn.com/files/8330c73d-a4c4-4e6a-bf5f-1d8a2cd45cdb/5568519517.pdf
- https://site-1039478.mozfiles.com/files/1039478/dapagufig.pdf
- https://site-1036698.mozfiles.com/files/1036698/darakugugudukagevoduz.pdf
- https://site-1037282.mozfiles.com/files/1037282/54986118038.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- cctraff.ru
- kuvapepod.kirtanpath.com
- duburur.rmelectricsolutions.com
- files.waltonplumbingandheating.com
- fomogam.flygirlfitness.com
- site-1042277.mozfiles.com
- site-1039424.mozfiles.com
- site-1037160.mozfiles.com
- site-1038338.mozfiles.com
- site-1041372.mozfiles.com
- uploads.strikinglycdn.com
- site-1039478.mozfiles.com
- site-1036698.mozfiles.com
- site-1037282.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report