SUSPICIOUS — 31310727139.pdf

SUSPICIOUS — 31310727139.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: ece2cf869a32e4724d3cb2c87d43dd787b5239e4fbc4926b947e0d5bd0266c3d
• SHA-1: 40dcb89c2f55748c2a3bc7d30da47b2d5734ec73
• MD5: 553b59d1c00f22309f11ed863c63a8de
• ssdeep: 768:dgGzpDB/5ngF7ZhQzB1z58H1PAGVI16uR3rc6/zNgMIrLH47Lwg:eGFJ5L1zVl16Yc6/zKMIH47Lwg
• TLSH: T1EF328CF350A7ED4C7A87DB136EAE285D908AD68C6033EB5408883B6CC47C77C6E51860
• Submitted as: 31310727139.pdf
• File type: pdf · Size: 44003 bytes
• Verdict: suspicious (44/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/strik?keyword=macmillan+mcgraw+hill+treasures+grade+1, https://cdn.shopify.com/s/files/1/0440/7607/3125/files/partes_de_una_revista.pdf, https://cdn.shopify.com/s/files/1/0433/9712/0151/files/aces_limited_brands_associate_login.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=macmillan+mcgraw+hill+treasures+grade+1
• https://cdn.shopify.com/s/files/1/0440/7607/3125/files/partes_de_una_revista.pdf
• https://cdn.shopify.com/s/files/1/0433/9712/0151/files/aces_limited_brands_associate_login.pdf
• https://cdn.shopify.com/s/files/1/0430/2703/8371/files/nosazose.pdf
• https://cdn.shopify.com/s/files/1/0440/2534/8261/files/xetoja.pdf
• https://cdn.shopify.com/s/files/1/0483/8034/6525/files/cronus_paintball_gun_kit.pdf
• http://files.feemanagement.co.uk/uploads/1/3/1/3/131379530/e2272953f91d.pdf
• http://sugadisek.townofclevelandal.com/uploads/1/3/1/4/131408371/sodadore.pdf
• http://files.sv-integrity.com/uploads/1/3/1/8/131871772/8636334.pdf
• http://files.in2improv.org/uploads/1/3/0/9/130969910/kojuwodela.pdf
• http://files.chrislchristoff.com/uploads/1/3/1/3/131379546/1031661235.pdf
• http://fovupin.wpleli.com/uploads/1/3/1/8/131871787/sabepulu.pdf
• http://levoxoke.osteostrongtriad.com/uploads/1/3/2/6/132696056/112356.pdf
• http://noroko.creatingmen.com/uploads/1/3/1/3/131380771/acd4badd3ab6a5.pdf
• http://files.mokenameteormusic159.org/uploads/1/3/0/7/130775429/jaxuwewamid.pdf
• http://savomat.nsmforwellness.com/uploads/1/3/0/7/130776068/rudanufuzekal.pdf
• http://files.fixyourmess.com/uploads/1/3/1/3/131398185/083517.pdf
• http://tosewaw.eventsforyou.net/uploads/1/3/1/6/131637306/3233535.pdf
• http://files.generationsperforms.com/uploads/1/3/2/6/132681343/df0ebcea0d.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• cdn.shopify.com
• files.feemanagement.co.uk
• sugadisek.townofclevelandal.com
• files.sv-integrity.com
• files.in2improv.org
• files.chrislchristoff.com
• fovupin.wpleli.com
• levoxoke.osteostrongtriad.com
• noroko.creatingmen.com
• files.mokenameteormusic159.org
• savomat.nsmforwellness.com
• files.fixyourmess.com
• tosewaw.eventsforyou.net
• files.generationsperforms.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report