SUSPICIOUS — milisilabozoluxezaterujuj.pdf

SUSPICIOUS — milisilabozoluxezaterujuj.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: e59591ada4cc50acc65b305a4beaa8fd66344d6951801d3d46e937a81028661b
• SHA-1: cd8d148afdb2f01d4b5cf2db0aa4e0d9ec8f0079
• MD5: 229f387582ee9c3c62ea8e8afcb85ad9
• ssdeep: 1536:nGFdlO0X5tenKbQqusJ8GrGqHHwpZh6LsD:GFdbhBucrGGH8Zh6s
• TLSH: T10C35AEF35253DD4C7A8BDB036AEA24A84546DB4C2072D7B468D97B3CC5BC2BC6E41920
• Submitted as: milisilabozoluxezaterujuj.pdf
• File type: pdf · Size: 57632 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=kaplan+lecture+notes+step+1+pdf, http://files.anastasiaabrahim.com/uploads/1/3/1/0/131070737/eabeb0.pdf, http://files.firstbethelbaptistvarina.org/uploads/1/3/1/4/131483214/pifasesifedid_tifejuloromegi_xadalag_gusutulad.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=kaplan+lecture+notes+step+1+pdf
• http://files.anastasiaabrahim.com/uploads/1/3/1/0/131070737/eabeb0.pdf
• http://files.firstbethelbaptistvarina.org/uploads/1/3/1/4/131483214/pifasesifedid_tifejuloromegi_xadalag_gusutulad.pdf
• http://xamodalog.in2ithealth.info/uploads/1/3/0/7/130739655/6661ab82f4.pdf
• http://files.mirrors.co.nz/uploads/1/3/0/8/130814192/visefanunuzigagup.pdf
• http://files.dbworldphoto.com/uploads/1/3/2/6/132696210/kolokavujexu.pdf
• https://site-1042918.mozfiles.com/files/1042918/54966482587.pdf
• https://site-1038505.mozfiles.com/files/1038505/gejaxofo.pdf
• https://cdn.shopify.com/s/files/1/0482/1080/4890/files/mystic_divine_hair_color.pdf
• https://cdn.shopify.com/s/files/1/0437/1241/3847/files/progressive_era_video_questions_answers.pdf
• https://cdn.shopify.com/s/files/1/0483/7113/8711/files/49618006678.pdf
• https://site-1037124.mozfiles.com/files/1037124/jevonizovusowamojomexe.pdf
• https://site-1039833.mozfiles.com/files/1039833/vusegumalogapeto.pdf
• https://site-1036988.mozfiles.com/files/1036988/35784375246.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• files.anastasiaabrahim.com
• files.firstbethelbaptistvarina.org
• xamodalog.in2ithealth.info
• files.dbworldphoto.com
• site-1042918.mozfiles.com
• site-1038505.mozfiles.com
• cdn.shopify.com
• site-1037124.mozfiles.com
• site-1039833.mozfiles.com
• site-1036988.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com
• files.mirrors.co.nz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report