SUSPICIOUS — normal_5f89b961cdc51.pdf

SUSPICIOUS — normal_5f89b961cdc51.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 1b41ea733f8959ce351054decdd0e7281dd2e29e24d852ae2ca0120c34645504
• SHA-1: 8567663059ec49c43f1c1068229603d9b004f73b
• MD5: 18eee870723f1c1b80b368919ebdbdc2
• ssdeep: 768:iLgGzpDrpXa9lXufFPLRSEzCbaxpua06/vAuV/6fd99EcfVEiqWB+6MH5N5iIQn:nGFfpXvLphVr2pEcfVElWB+6MHToIQn
• TLSH: T159318EF7509BEDCD3ACAAB03AEAB015A618AD78860339650448C373CD47CAFD2E11D55
• Submitted as: normal_5f89b961cdc51.pdf
• File type: pdf · Size: 42631 bytes
• Verdict: suspicious (44/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ttraff.link/123?keyword=android+data+recovery+software+for+pc, https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/3731638.pdf, https://besiwalufeg.weebly.com/uploads/1/3/2/6/132696214/6624546.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ttraff.link/123?keyword=android+data+recovery+software+for+pc
• https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/3731638.pdf
• https://besiwalufeg.weebly.com/uploads/1/3/2/6/132696214/6624546.pdf
• https://pidofuvu.weebly.com/uploads/1/3/0/7/130739764/09fdd66bdc5.pdf
• https://cdn.shopify.com/s/files/1/0482/3508/5978/files/copper_complex_ion_experiment.pdf
• https://cdn.shopify.com/s/files/1/0496/5629/9671/files/jordin_sparks_battlefield_lyrics.pdf
• https://cdn.shopify.com/s/files/1/0430/2936/4899/files/44827570687.pdf
• https://cdn.shopify.com/s/files/1/0476/6747/8694/files/razefok.pdf
• https://cdn.shopify.com/s/files/1/0503/7060/9312/files/blue_springs_marina_boat_rental.pdf
• https://cdn-cms.f-static.net/uploads/4368746/normal_5f8892546dcd2.pdf
• https://cdn-cms.f-static.net/uploads/4366316/normal_5f875b3ee39b6.pdf
• https://uploads.strikinglycdn.com/files/f86d73df-be26-47d0-8398-4c134d5f5f2b/46784534754.pdf
• https://uploads.strikinglycdn.com/files/4d1102cf-1e17-4731-80c2-b4b91dc73527/72618413878.pdf
• https://uploads.strikinglycdn.com/files/6c579807-7761-476d-a94f-262629fd82e3/88276740769.pdf
• https://uploads.strikinglycdn.com/files/fed1e1c9-77e3-49cb-8e0e-d499dd0a02d1/beregevagipowigopikumomo.pdf
• https://cdn.shopify.com/s/files/1/0437/5104/7329/files/jokiwobedorefomikuwidil.pdf
• https://cdn.shopify.com/s/files/1/0463/1062/1341/files/35960694989.pdf
• https://cdn.shopify.com/s/files/1/0434/3886/6597/files/billy_twin_peaks_reddit.pdf
• https://cdn.shopify.com/s/files/1/0493/8819/1906/files/501801353.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• gimejexoxixaza.weebly.com
• besiwalufeg.weebly.com
• pidofuvu.weebly.com
• cdn.shopify.com
• cdn-cms.f-static.net
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report