SUSPICIOUS — normal_5f8bd5dca3255.pdf

SUSPICIOUS — normal_5f8bd5dca3255.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 080b8669278f33bd48f7c10fdff4d1bac4f2afd17a3ea0f6b4b89131d01e5263
• SHA-1: ca7b84d5dce7954b07e7ccc58a172c8019e97cfc
• MD5: 77edaf68ade2e58175d905431c01a732
• ssdeep: 1536:TGF2pIfQMHl6F6KnDBPrP+JsucnV1Jq5:iF2pI4MHw6o9+iDV16
• TLSH: T1E734AEF350A7ED8C7A9AEB07EDAB105D514AD788A036DB6014CC672CC5786FC7E40A60
• Submitted as: normal_5f8bd5dca3255.pdf
• File type: pdf · Size: 52388 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://gettraff.ru/123?keyword=fifa+19+apk+%252B+obb+file+download, https://cdn.shopify.com/s/files/1/0479/2906/5628/files/measuring_volume_worksheets.pdf, https://cdn.shopify.com/s/files/1/0497/4624/7833/files/60154724315.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/123?keyword=fifa+19+apk+%252B+obb+file+download
• https://cdn.shopify.com/s/files/1/0479/2906/5628/files/measuring_volume_worksheets.pdf
• https://cdn.shopify.com/s/files/1/0497/4624/7833/files/60154724315.pdf
• https://cdn.shopify.com/s/files/1/0499/2463/6823/files/managing_projects_a_team-based_approach.pdf
• https://cdn.shopify.com/s/files/1/0495/9843/1381/files/12173505585.pdf
• https://cdn.shopify.com/s/files/1/0434/0783/5303/files/the_book_thief_summary.pdf
• https://cdn.shopify.com/s/files/1/0483/1795/6260/files/jasawateda.pdf
• https://cdn.shopify.com/s/files/1/0481/6093/1991/files/feldman_government_contract_guidebook.pdf
• https://uploads.strikinglycdn.com/files/82b2b0e2-1795-4034-884a-c7f451b46ad4/25190839337.pdf
• https://uploads.strikinglycdn.com/files/75179195-e575-422e-ae24-7b4f2cdca98b/pevibedigazemojaxukujok.pdf
• https://uploads.strikinglycdn.com/files/0f2c39c2-e9b3-4904-b110-7d5c3003888d/10353336140.pdf
• https://cdn.shopify.com/s/files/1/0476/7481/8726/files/turbo_pascal_book.pdf
• https://cdn.shopify.com/s/files/1/0484/6433/0913/files/42775824083.pdf
• https://cdn.shopify.com/s/files/1/0493/2275/4207/files/76737358940.pdf
• https://varipejat.weebly.com/uploads/1/3/0/7/130739080/karix.pdf
• https://goduvozimaku.weebly.com/uploads/1/3/1/3/131380582/padixejo.pdf
• https://kuromazu.weebly.com/uploads/1/3/2/6/132695519/6dc5a.pdf
• https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/divili_dapixi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• cdn.shopify.com
• uploads.strikinglycdn.com
• varipejat.weebly.com
• goduvozimaku.weebly.com
• kuromazu.weebly.com
• jakedekokobara.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report