SUSPICIOUS — normal_5f8788f4b8e44.pdf
SUSPICIOUS — normal_5f8788f4b8e44.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
1210fdc0905feefcc25bcec6889b962b92530e84da5c654e42adf96a2459ab17 - SHA-1:
2c33b979a85c3c95d56a55d2da93e599315271af - MD5:
4dc418b33e567563f21e0998e195a884 - ssdeep:
768:wLgGzpDMpF+L5TPIW8nZK4zS7N68GpO34mFCaEDHP9ji8OmRK3KGlEAhakI1Jkqn:JGFQpw6pmWHPpOmc3KGeAY3oPDtN+D - TLSH:
T1EC32AEF750A7EC8C7A87AB07ACE611695589C38CA136EB9055CC362CD17C6BD7F60820 - Submitted as: normal_5f8788f4b8e44.pdf
- File type: pdf · Size: 43744 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=how+to+read+cpu+usage+android, https://cdn.shopify.com/s/files/1/0440/9019/6133/files/vulpin_adventure_soundtrack.pdf, https://cdn.shopify.com/s/files/1/0486/4802/8318/files/95301069267.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/123?keyword=how+to+read+cpu+usage+android
- https://cdn.shopify.com/s/files/1/0440/9019/6133/files/vulpin_adventure_soundtrack.pdf
- https://cdn.shopify.com/s/files/1/0486/4802/8318/files/95301069267.pdf
- https://cdn.shopify.com/s/files/1/0502/4517/3413/files/lekelukex.pdf
- https://site-1040239.mozfiles.com/files/1040239/jeriponare.pdf
- https://site-1037261.mozfiles.com/files/1037261/67526313937.pdf
- https://site-1039226.mozfiles.com/files/1039226/29382167600.pdf
- https://site-1038975.mozfiles.com/files/1038975/rupegupekexavedor.pdf
- https://cdn-cms.f-static.net/uploads/4366652/normal_5f8770125a047.pdf
- https://cdn-cms.f-static.net/uploads/4367303/normal_5f874fe2df846.pdf
- https://cdn-cms.f-static.net/uploads/4366365/normal_5f8751a815240.pdf
- https://cdn-cms.f-static.net/uploads/4365562/normal_5f876753da140.pdf
- https://cdn-cms.f-static.net/uploads/4366047/normal_5f87820da0fe8.pdf
- https://cdn-cms.f-static.net/uploads/4366029/normal_5f8727ca99583.pdf
- https://cdn-cms.f-static.net/uploads/4365635/normal_5f876bff2dd22.pdf
- https://cdn-cms.f-static.net/uploads/4366305/normal_5f876ecea7a52.pdf
- https://cdn.shopify.com/s/files/1/0484/5495/9265/files/tutilapikutuzunomesuwute.pdf
- https://cdn.shopify.com/s/files/1/0480/1042/8575/files/46486836746.pdf
- https://cdn.shopify.com/s/files/1/0493/0070/1343/files/spring_view_middle_school_hb.pdf
- https://site-1038998.mozfiles.com/files/1038998/28090893649.pdf
- https://site-1041413.mozfiles.com/files/1041413/4079277213.pdf
- https://site-1042731.mozfiles.com/files/1042731/lepuremelebanajoki.pdf
- https://site-1041076.mozfiles.com/files/1041076/duviwunafiwum.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- gettraff.ru
- cdn.shopify.com
- site-1040239.mozfiles.com
- site-1037261.mozfiles.com
- site-1039226.mozfiles.com
- site-1038975.mozfiles.com
- cdn-cms.f-static.net
- site-1038998.mozfiles.com
- site-1041413.mozfiles.com
- site-1042731.mozfiles.com
- site-1041076.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report