SUSPICIOUS — rolivexoti.pdf
SUSPICIOUS — rolivexoti.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
eddade67ecc802bd019c98aade675e325f8be9034ba4083d852d9bf4724140f2 - SHA-1:
cfe66f0436b4e6fe871f75eb46758449d3f152ea - MD5:
5a2d5d0cca40ab8a0175dfa338c0eb95 - ssdeep:
768:+gGzpDfQh6UJslvwTjGjSNAAIjLHX2tyrBflbxHjPCyg22JaQ:7GFrsTRNgHXcaBflbZjPCyD2JaQ - TLSH:
T1B3318DF301A7ED4C7AD79F43ADA61068A18AC7483136A754448877AC84BC5FEBF509A0 - Submitted as: rolivexoti.pdf
- File type: pdf · Size: 42828 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=uncontrollably+fond+online+latino, https://uploads.strikinglycdn.com/files/b54c84c9-73d4-40b7-81fc-36dfc41ea9a5/28956779996.pdf, https://uploads.strikinglycdn.com/files/d3395903-1f17-4860-bf93-bc16f63dd72d/46161200591.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://gettraff.ru/strik?keyword=uncontrollably+fond+online+latino
- https://uploads.strikinglycdn.com/files/b54c84c9-73d4-40b7-81fc-36dfc41ea9a5/28956779996.pdf
- https://uploads.strikinglycdn.com/files/d3395903-1f17-4860-bf93-bc16f63dd72d/46161200591.pdf
- https://uploads.strikinglycdn.com/files/56eaa279-648b-4924-a97f-422e95f8e02a/88697862528.pdf
- https://uploads.strikinglycdn.com/files/9da385f3-4804-4b42-8e6e-fcb2db60999f/33513509329.pdf
- https://cdn.shopify.com/s/files/1/0481/0588/1763/files/pack_and_paddle.pdf
- https://cdn.shopify.com/s/files/1/0485/7590/5957/files/better_homes_and_gardens_4_cube_organizer_rustic_gray_finish.pdf
- https://cdn.shopify.com/s/files/1/0485/0447/1713/files/bai_hat_au_nhi_ca.pdf
- https://cdn.shopify.com/s/files/1/0429/2247/5687/files/saleropazimopabugi.pdf
- https://cdn.shopify.com/s/files/1/0437/0602/4090/files/bose_acoustimass_6_series_iii_wiring_diagram.pdf
- https://site-1044238.mozfiles.com/files/1044238/balawogelozekopabom.pdf
- https://site-1039998.mozfiles.com/files/1039998/39537966662.pdf
- https://site-1041282.mozfiles.com/files/1041282/3510741025.pdf
- https://site-1037177.mozfiles.com/files/1037177/bural.pdf
- https://site-1037026.mozfiles.com/files/1037026/5046734466.pdf
- http://files.stocklawgaprally.com/uploads/1/3/0/8/130873946/gizadax.pdf
- http://files.wagneraqualab.com/uploads/1/3/1/6/131636965/92df3a9d.pdf
- http://files.mikecurtisfootball.com/uploads/1/3/1/4/131410007/lamisuz.pdf
- http://vevowu.phantomlightning.com/uploads/1/3/0/7/130775172/73ee3ae.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- site-1044238.mozfiles.com
- site-1039998.mozfiles.com
- site-1041282.mozfiles.com
- site-1037177.mozfiles.com
- site-1037026.mozfiles.com
- files.stocklawgaprally.com
- files.wagneraqualab.com
- files.mikecurtisfootball.com
- vevowu.phantomlightning.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report