SUSPICIOUS — 92693953086.pdf

SUSPICIOUS — 92693953086.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: c39ca839a333a4fbd929274fdb9a51af3968ac77e7af3f9842d0816a113a8057
• SHA-1: 5ba9f6d3a1a0d3cc25a825dfea34e96a79bf1b53
• MD5: fdf57f3b2ea2b3ccb5a5fe90c3f32516
• ssdeep: 3072:+FMVYd2XLpkObzcXBGaJW5LcXIihpCzaFeL:ODj11pC9
• TLSH: T18F3CF1F31086EE8C798BBF43A9A518646149CB8C6131DB50098C7FACC5F83FDAE51660
• Submitted as: 92693953086.pdf
• File type: pdf · Size: 116101 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=bahubali+2+full+movie+3gp+video, http://bilom.bshelart.com/uploads/1/3/1/6/131636664/60a47e6222.pdf, http://files.gtheisen.com/uploads/1/3/0/7/130776462/tubufefez.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=bahubali+2+full+movie+3gp+video
• http://bilom.bshelart.com/uploads/1/3/1/6/131636664/60a47e6222.pdf
• http://files.gtheisen.com/uploads/1/3/0/7/130776462/tubufefez.pdf
• http://files.frontroomon7th.com/uploads/1/3/1/4/131453725/lewutudozefu.pdf
• http://files.pdjensenartist.com/uploads/1/3/0/8/130814935/wogitekor-lefibawifa.pdf
• http://files.biggestrebel.com/uploads/1/3/0/7/130775905/potidilinesefu.pdf
• https://site-1039266.mozfiles.com/files/1039266/35719127021.pdf
• https://site-1037207.mozfiles.com/files/1037207/72653005793.pdf
• https://cdn.shopify.com/s/files/1/0457/3750/9020/files/63935791783.pdf
• https://cdn.shopify.com/s/files/1/0482/2410/8696/files/6-3_practice_form_g_proving_that_a_quadrilateral_is_a_parallelogram.pdf
• https://cdn.shopify.com/s/files/1/0437/5419/3047/files/oshkosh_area_school_district_phone_number.pdf
• https://cdn.shopify.com/s/files/1/0433/5140/8799/files/wahl_deluxe_chrome_pro_walmart.pdf
• https://cdn.shopify.com/s/files/1/0433/8181/7494/files/a_christmas_carol_act_1_crossword_puzzle_answers.pdf
• https://site-1037854.mozfiles.com/files/1037854/84188740409.pdf
• https://site-1037124.mozfiles.com/files/1037124/wowoxalebiwutu.pdf
• https://site-1037121.mozfiles.com/files/1037121/vugafanobik.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• bilom.bshelart.com
• files.gtheisen.com
• files.frontroomon7th.com
• files.pdjensenartist.com
• files.biggestrebel.com
• site-1039266.mozfiles.com
• site-1037207.mozfiles.com
• cdn.shopify.com
• site-1037854.mozfiles.com
• site-1037124.mozfiles.com
• site-1037121.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report