SUSPICIOUS — 1826235593.pdf
SUSPICIOUS — 1826235593.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
e1cdc51922ebee543127bae8cf2570a98fa3c3923912ccbbae0c62052bd70a51 - SHA-1:
173bd0b315eb34db87548031e2ec410365b74c65 - MD5:
46ff2a79d9c45db40c6bc96d64fcde1e - ssdeep:
768:QXgGzpDgO1RznRO2j9gpnRBM8UZkeLsb6NGgBM9UMS4TsTIa:1GFU+AbpntUJLshsLX6kIa - TLSH:
T1A131AEF35097DD48B9C79B83ADE310582188C28CB232A76449D87B6DC8BC7BD6F50960 - Submitted as: 1826235593.pdf
- File type: pdf · Size: 41787 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/strik?keyword=answers+for+elementary+statistics+7th+edition, https://site-1037846.mozfiles.com/files/1037846/sasotodiwasoka.pdf, https://site-1037222.mozfiles.com/files/1037222/90772884602.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://ggtraff.ru/strik?keyword=answers+for+elementary+statistics+7th+edition
- https://site-1037846.mozfiles.com/files/1037846/sasotodiwasoka.pdf
- https://site-1037222.mozfiles.com/files/1037222/90772884602.pdf
- https://site-1040568.mozfiles.com/files/1040568/21085214505.pdf
- https://site-1042585.mozfiles.com/files/1042585/gubevanekumil.pdf
- https://site-1039533.mozfiles.com/files/1039533/lovasupilul.pdf
- https://site-1040262.mozfiles.com/files/1040262/latenerozesagusixa.pdf
- https://site-1039932.mozfiles.com/files/1039932/ripulebisunovupafoxevow.pdf
- https://site-1042554.mozfiles.com/files/1042554/besawu.pdf
- http://xabed.faithonmain.com/uploads/1/3/0/7/130775934/7996459.pdf
- http://files.wagincrc.com/uploads/1/3/2/6/132695278/2979268.pdf
- http://files.toddbhudson.com/uploads/1/3/1/4/131437319/cd7ae58f80face1.pdf
- http://fevopenap.leticiamarteleto.org/uploads/1/3/1/3/131379256/2109606.pdf
- http://files.forb-learning.org/uploads/1/3/1/4/131483520/802269.pdf
- http://files.susanlane-gardenscapes.com/uploads/1/3/0/7/130740530/puramutisigema-ridife-tolifojobifa-teregaximo.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- site-1037846.mozfiles.com
- site-1037222.mozfiles.com
- site-1040568.mozfiles.com
- site-1042585.mozfiles.com
- site-1039533.mozfiles.com
- site-1040262.mozfiles.com
- site-1039932.mozfiles.com
- site-1042554.mozfiles.com
- xabed.faithonmain.com
- files.wagincrc.com
- files.toddbhudson.com
- fevopenap.leticiamarteleto.org
- files.forb-learning.org
- files.susanlane-gardenscapes.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report