SUSPICIOUS — 12545416796.pdf

SUSPICIOUS — 12545416796.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ee64a7a594e8a5a157a21b84c4fe3543332cfbf6403b0b6ca93eb7de56bc56ed
• SHA-1: 040c0d94e33986d0ad39218c65d9d6ecc815b121
• MD5: 9436516aae84eb966e4b3386f1725a6c
• ssdeep: 768:ygGzpDP/atmVMjJURXdaBshn6CdgPo1Bk/e3ko/PU4gfDVVDr:vGF7C5BigPqBkW3p/sJhVDr
• TLSH: T14B30AEF35067EC4D2A86AB437CEB10A96149C68C6233A73059987B2CC97C5FC7E60D60
• Submitted as: 12545416796.pdf
• File type: pdf · Size: 38811 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=statistical+quality+control+douglas+montgomery+pdf, https://cdn.shopify.com/s/files/1/0433/8089/9991/files/kagisuxifijejumede.pdf, https://cdn.shopify.com/s/files/1/0431/7508/4193/files/anne_marie_ciao_adios_free.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/strik?keyword=statistical+quality+control+douglas+montgomery+pdf
• https://cdn.shopify.com/s/files/1/0433/8089/9991/files/kagisuxifijejumede.pdf
• https://cdn.shopify.com/s/files/1/0431/7508/4193/files/anne_marie_ciao_adios_free.pdf
• https://cdn.shopify.com/s/files/1/0431/6348/4315/files/21744527778.pdf
• https://cdn.shopify.com/s/files/1/0435/2199/9003/files/15588937813.pdf
• https://cdn.shopify.com/s/files/1/0433/9807/0435/files/fexeduretegixem.pdf
• http://xukedezes.susieruthscott.com/uploads/1/3/1/0/131070581/tuladirutebajer_sidaxumiwonupu_matipadezi_xofex.pdf
• http://mitaz.arkansasmath.com/uploads/1/3/1/1/131164250/3467441.pdf
• https://cdn.shopify.com/s/files/1/0463/6943/9899/files/95741698073.pdf
• https://cdn.shopify.com/s/files/1/0429/6690/9081/files/ant_er_chrome_mac.pdf
• https://cdn.shopify.com/s/files/1/0428/2191/0694/files/61391400353.pdf
• https://cdn.shopify.com/s/files/1/0434/1638/7733/files/building_planning_and_design_books.pdf
• https://cdn.shopify.com/s/files/1/0438/4463/2738/files/bls_course_aha.pdf
• https://cdn.shopify.com/s/files/1/0431/7950/7880/files/61119813373.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• cdn.shopify.com
• xukedezes.susieruthscott.com
• mitaz.arkansasmath.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report