SUSPICIOUS — 27376878848.pdf

SUSPICIOUS — 27376878848.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: ff28106b7d7cec0f0d73433fe2d11ab9a657a0b8ec4f311928391306376f46ea
• SHA-1: 90b3a90bdf39079ff60a397f802b4662d6ea0c19
• MD5: a77b047d338522a88910849564ab1df8
• ssdeep: 1536:yGF0fTdEF2n+fBWGJ7wKPZ7o5/6N0vsv:rF0f2MnYBWGtwKPBoA0s
• TLSH: T13E34CFF3912ADD4C7683A7471EA9204A7116D78C2171E6244CEA7A2CC57C3FC6E40E71
• Submitted as: 27376878848.pdf
• File type: pdf · Size: 56393 bytes
• Verdict: suspicious (44/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/strik?keyword=introduction+to+java+programming+liang, https://site-1043256.mozfiles.com/files/1043256/mitifirenakipufezoteg.pdf, https://site-1036876.mozfiles.com/files/1036876/xodutidozesuxos.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/strik?keyword=introduction+to+java+programming+liang
• https://site-1043256.mozfiles.com/files/1043256/mitifirenakipufezoteg.pdf
• https://site-1036876.mozfiles.com/files/1036876/xodutidozesuxos.pdf
• https://site-1039721.mozfiles.com/files/1039721/sipejilefavun.pdf
• https://site-1038992.mozfiles.com/files/1038992/86630477222.pdf
• http://wugubovat.valleycrafthavenandsupplies.net/uploads/1/3/1/8/131871729/2715250.pdf
• http://favufason.thegrindconnected.com/uploads/1/3/1/4/131407067/xupebib-vabije.pdf
• http://files.unveilinglaureng.com/uploads/1/3/1/4/131483214/0574b93b1395.pdf
• http://zimif.melissamccartney.co/uploads/1/3/2/3/132302998/xepegigibapoje.pdf
• http://nuxuxule.iamsarahstorm.com/uploads/1/3/1/0/131070161/39820b274a.pdf
• https://site-1041773.mozfiles.com/files/1041773/todemovop.pdf
• https://site-1040038.mozfiles.com/files/1040038/97686134500.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• site-1043256.mozfiles.com
• site-1036876.mozfiles.com
• site-1039721.mozfiles.com
• site-1038992.mozfiles.com
• wugubovat.valleycrafthavenandsupplies.net
• favufason.thegrindconnected.com
• files.unveilinglaureng.com
• zimif.melissamccartney.co
• nuxuxule.iamsarahstorm.com
• site-1041773.mozfiles.com
• site-1040038.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report