SUSPICIOUS — normal_5f87271762e3c.pdf
SUSPICIOUS — normal_5f87271762e3c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
15b459b668d3f51b5d69f7789e0220e30a81fb9f6b2e3bcfc1276f0e59129ee2 - SHA-1:
aae8ccb7f6177d41ae3932eac919261cac9f6802 - MD5:
69ac023a4f29521e868542826ccfc1d3 - ssdeep:
1536:MGFPpUqIWu1abJhuKfUmcUKziwshrU5WmKj/2+:pFPpjIl1a6fmcUIiV9OAD - TLSH:
T1EC338DF301A7ED8CBA8B7F03AAAB10585145DB8D6272D7A054C8376DC4BC6FD6E01660 - Submitted as: normal_5f87271762e3c.pdf
- File type: pdf · Size: 51025 bytes
- Verdict: suspicious (44/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/123?keyword=es+file+explorer+black+theme+apk, https://uploads.strikinglycdn.com/files/3de6e975-96a5-4d28-9cd2-c83d31db5b1b/xolozafedizoriv.pdf, https://uploads.strikinglycdn.com/files/53e7dba7-7ea0-4c9a-9f90-ba8608b2b972/bebuxapotixuta.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=es+file+explorer+black+theme+apk
- https://uploads.strikinglycdn.com/files/3de6e975-96a5-4d28-9cd2-c83d31db5b1b/xolozafedizoriv.pdf
- https://uploads.strikinglycdn.com/files/53e7dba7-7ea0-4c9a-9f90-ba8608b2b972/bebuxapotixuta.pdf
- https://uploads.strikinglycdn.com/files/b22a5332-6c1f-494e-b9d0-84b28976b9f6/gilolerolabefeluvusurib.pdf
- https://cdn.shopify.com/s/files/1/0266/8976/5561/files/uber_cost_rohnert_park_to_santa_rosa.pdf
- https://cdn.shopify.com/s/files/1/0496/6980/0089/files/68524287532.pdf
- https://site-1040571.mozfiles.com/files/1040571/nasomonu.pdf
- https://site-1039426.mozfiles.com/files/1039426/tolalinikinadogivawoja.pdf
- https://site-1043177.mozfiles.com/files/1043177/zasawilubazejudod.pdf
- https://site-1040997.mozfiles.com/files/1040997/xogadodelolasatam.pdf
- https://site-1043494.mozfiles.com/files/1043494/jupabizegefenodofilodoti.pdf
- https://site-1039320.mozfiles.com/files/1039320/70028928166.pdf
- https://site-1038703.mozfiles.com/files/1038703/gupirozivule.pdf
- https://jeponiruwapin.weebly.com/uploads/1/3/0/7/130776483/timafu-wevaxanarewo.pdf
- https://jeponiruwapin.weebly.com/uploads/1/3/0/7/130776483/fozojige-fagejo.pdf
- https://povutepumik.weebly.com/uploads/1/3/2/7/132741486/4b201c87d.pdf
- https://fekudumubaf.weebly.com/uploads/1/3/2/6/132681201/d35f11698e4898.pdf
- https://site-1040041.mozfiles.com/files/1040041/kimuwitasa.pdf
- https://site-1042442.mozfiles.com/files/1042442/68828312782.pdf
- https://site-1038782.mozfiles.com/files/1038782/include_beamer_latex.pdf
- https://site-1041684.mozfiles.com/files/1041684/bonepubufodivenezonezodi.pdf
- https://site-1042834.mozfiles.com/files/1042834/fekixividop.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- site-1040571.mozfiles.com
- site-1039426.mozfiles.com
- site-1043177.mozfiles.com
- site-1040997.mozfiles.com
- site-1043494.mozfiles.com
- site-1039320.mozfiles.com
- site-1038703.mozfiles.com
- jeponiruwapin.weebly.com
- povutepumik.weebly.com
- fekudumubaf.weebly.com
- site-1040041.mozfiles.com
- site-1042442.mozfiles.com
- site-1038782.mozfiles.com
- site-1041684.mozfiles.com
- site-1042834.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report