SUSPICIOUS — 73787983934.pdf

SUSPICIOUS — 73787983934.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: c4ddd87cb774de6af7d9c9112e38be399ac8d34176feeae67b5ad725b83a2eed
• SHA-1: 96003b573eb05a3087b03f9edaa06715b7414b15
• MD5: 964a32c5053ade77fe1c6e0e940714b9
• ssdeep: 1536:iGFBWTBphkwLJ8K8S86Zw4+t6AGuYth1bWkLN4:bFBWTfZL+K8qwNtBGh13S
• TLSH: T1D635BFF3809BCD4C7A85AB172EBB2418A14AD7892172A7A444C5B32DC4BC3FDBE51D11
• Submitted as: 73787983934.pdf
• File type: pdf · Size: 59984 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=refraction+through+prism+class+12+pdf, http://files.murphysheanon.ie/uploads/1/3/0/7/130776263/wanarumogovabano.pdf, http://pefovo.brilliantheartpr.co/uploads/1/3/2/6/132681670/dexosaduv_texobojagafisik_nukipidisotu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/strik?keyword=refraction+through+prism+class+12+pdf
• http://files.murphysheanon.ie/uploads/1/3/0/7/130776263/wanarumogovabano.pdf
• http://pefovo.brilliantheartpr.co/uploads/1/3/2/6/132681670/dexosaduv_texobojagafisik_nukipidisotu.pdf
• http://files.sheltermusicboston.org/uploads/1/3/1/4/131406173/serulox.pdf
• http://files.loveletterpressauthors.com/uploads/1/3/1/1/131163540/55b650765c1344a.pdf
• http://woxoturuj.heroafterschoolcentre.org/uploads/1/3/0/7/130775889/kevebutuxenitazep.pdf
• https://cdn.shopify.com/s/files/1/0431/4444/6118/files/taxunokijufiputigi.pdf
• https://cdn.shopify.com/s/files/1/0440/9032/7205/files/capturing_mary_2007.pdf
• https://cdn.shopify.com/s/files/1/0434/5430/0312/files/75011065438.pdf
• https://uploads.strikinglycdn.com/files/1a1c1071-64b3-4248-a6dd-9afce40a4a50/62622882594.pdf
• https://uploads.strikinglycdn.com/files/4274f596-46e0-4118-90e7-7d9970b070d5/59398681139.pdf
• https://uploads.strikinglycdn.com/files/169f3a23-cb3d-40ae-bf46-c4b4f94f11c0/44916989552.pdf
• https://uploads.strikinglycdn.com/files/b9dbd975-868d-4fb0-91d0-434c8e689fcf/28331454571.pdf
• https://uploads.strikinglycdn.com/files/9a1924bb-5cc2-454a-a3e3-1503a9c3e376/82683967525.pdf
• https://uploads.strikinglycdn.com/files/976acb3a-de83-433b-aeae-34bb952253d9/15917252853.pdf
• https://uploads.strikinglycdn.com/files/1c93a53a-48e1-4205-b378-f1ee10cb2ff4/26110392038.pdf
• https://uploads.strikinglycdn.com/files/c2f38065-831b-43d5-abcd-d9e7db129e73/kipemoremina.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• pefovo.brilliantheartpr.co
• files.sheltermusicboston.org
• files.loveletterpressauthors.com
• woxoturuj.heroafterschoolcentre.org
• cdn.shopify.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com
• files.murphysheanon.ie

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report