SUSPICIOUS — osrs_god_rune_armor.pdf

SUSPICIOUS — osrs_god_rune_armor.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: e27917bd0e38cdfa7c98eb809e7aee2d6d2e229779bcb6a8a7dbc2a27188346c
• SHA-1: ae89321e1e3da4cfb306d93359ae66cacd12ffbd
• MD5: 728e2426e27c42e86eeb14169cc72015
• ssdeep: 768:1gGzpDW2v9vmlPXFXsWXeiei0kwE07waXlz7AE16:mGFCNFLe7izFc5XlvAE16
• TLSH: T1F231AEF35097ED8C3ACAAB036DDA00696142D7CC612786A094D93B6CC4FC2FDAE50971
• Submitted as: osrs_god_rune_armor.pdf
• File type: pdf · Size: 39464 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=osrs+god+rune+armor, https://cdn.shopify.com/s/files/1/0477/4694/1084/files/iso_guide_73.pdf, https://uploads.strikinglycdn.com/files/f2b6bf43-9319-497d-af97-415bdc7e16f3/bafa_bafa_instructions.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/strik?keyword=osrs+god+rune+armor
• https://cdn.shopify.com/s/files/1/0477/4694/1084/files/iso_guide_73.pdf
• https://cdn.shopify.com/s/files/1/0506/9157/1905/files/the_tin_forest_activities.pdf
• https://s3.amazonaws.com/divelikubapiwaj/mugumuxuzutapuwazudunob.pdf
• https://s3.amazonaws.com/senodiw/44133369904.pdf
• https://s3.amazonaws.com/pazifetanegapu/samebanivenejafifi.pdf
• https://uploads.strikinglycdn.com/files/f2b6bf43-9319-497d-af97-415bdc7e16f3/bafa_bafa_instructions.pdf
• https://s3.amazonaws.com/paxivogedewilu/cooper_burbank_recruiting.pdf
• https://uploads.strikinglycdn.com/files/2b10896e-2255-4c6d-979b-c0385cc7860e/robot_mod_sims_4.pdf
• https://cdn-cms.f-static.net/uploads/4378620/normal_5f92310d771ba.pdf
• https://s3.amazonaws.com/pezofut/western_psychological_and_counseling_services_reviews.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• cdn.shopify.com
• s3.amazonaws.com
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report