SUSPICIOUS — sirezijumosogarovemu.pdf

SUSPICIOUS — sirezijumosogarovemu.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: faa2b4d84fb95c6a2dddfcd76af0cf87101240ee4d532e20a24517302094253e
• SHA-1: b1e16edf60c6a43e3c9c3cab8c91d681c6e10d14
• MD5: 58db8d309347b78dea034747cb77ff6a
• ssdeep: 768:ogGzpDEUKKH9flk/SST94yo7wIlsMwR/szJCVQHQPNJN5foHdx8:lGFwTSSTyiIlsMwdszJCVPPNJN5fov8
• TLSH: T10A319EF354EBEC8C698AAF436AE31099508AC38C6137A76055CC7B2DC4BC6ED7E50461
• Submitted as: sirezijumosogarovemu.pdf
• File type: pdf · Size: 41873 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=search+for+pdf+text, https://cdn.shopify.com/s/files/1/0466/2686/5317/files/budget_speech_2019_rajasthan.pdf, https://cdn.shopify.com/s/files/1/0434/0508/2776/files/naa_autograph_songs_in_naa_songs.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/strik?keyword=search+for+pdf+text
• https://cdn.shopify.com/s/files/1/0466/2686/5317/files/budget_speech_2019_rajasthan.pdf
• https://cdn.shopify.com/s/files/1/0434/0508/2776/files/naa_autograph_songs_in_naa_songs.pdf
• https://cdn.shopify.com/s/files/1/0433/6166/5192/files/xemevekum.pdf
• https://uploads.strikinglycdn.com/files/aad4e80f-680e-41f1-baaf-bf1b25370fb1/87975721981.pdf
• https://uploads.strikinglycdn.com/files/fd994540-7dfb-4d20-b837-8e02b2d22860/23224933024.pdf
• https://uploads.strikinglycdn.com/files/a3b4ad5c-3fdd-464c-b1a2-5136edd480cf/webeloborepelatetedabu.pdf
• https://uploads.strikinglycdn.com/files/66a5ec6f-acb8-48d8-9ac4-428311c265bc/ninodal.pdf
• https://uploads.strikinglycdn.com/files/5bc826a1-0035-407b-a50b-124d89574a63/zijudifivokuvopiso.pdf
• http://files.lyricallyjustified.co.uk/uploads/1/3/0/7/130775953/wikibuxo_jumewow.pdf
• http://nabaretax.kennethbuzo.com/uploads/1/3/1/4/131409098/xakixuramobeponiref.pdf
• http://jawikub.mariaberent.com/uploads/1/3/1/0/131069991/kagoz.pdf
• http://pives.stringtheorymusicjax.com/uploads/1/3/2/8/132815002/lutesitijekes-komapofi.pdf
• http://files.borromeogift.org/uploads/1/3/0/7/130775025/debirizifivinu-dugirov-zuledifuxeb-bigevorozelenar.pdf
• http://saruzi.kelliescompass.com/uploads/1/3/1/4/131437918/d107b.pdf
• http://files.wormfoodforthough.net/uploads/1/3/0/9/130969243/e9c22e71c4f8.pdf
• http://kabimili.transitionintowellness.com/uploads/1/3/1/4/131482975/6d77783de.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• cdn.shopify.com
• uploads.strikinglycdn.com
• files.lyricallyjustified.co.uk
• nabaretax.kennethbuzo.com
• jawikub.mariaberent.com
• pives.stringtheorymusicjax.com
• files.borromeogift.org
• saruzi.kelliescompass.com
• files.wormfoodforthough.net
• kabimili.transitionintowellness.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report