SUSPICIOUS — normal_5f875ae981692.pdf
SUSPICIOUS — normal_5f875ae981692.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
1c39f56e1ad35bf96622ea53b92da4ae45567c3efa23aa98f62c58bd55044aaa - SHA-1:
6aa89d88e2eec84b279eeda322ba2913ad66d16f - MD5:
a5dc05e84f25ab953d823f4250fc418a - ssdeep:
768:ggGzpDEptVFUV4qDuz6fJucrTd8nbmxgbESxRuywB+8YvS:tGFopMJB8naqESJ8YvS - TLSH:
T140306CF351A3ED8C7A8FAF476DA71199B089C38C612297604588772CD4BC6EC7F10A24 - Submitted as: normal_5f875ae981692.pdf
- File type: pdf · Size: 36938 bytes
- Verdict: suspicious (35/100)
Detections (2 of 53 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=descargar+heads+up+notifications+apk, https://site-1042969.mozfiles.com/files/1042969/dosixifivivuborut.pdf, https://site-1036965.mozfiles.com/files/1036965/18789143087.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/123?keyword=descargar+heads+up+notifications+apk
- https://site-1042969.mozfiles.com/files/1042969/dosixifivivuborut.pdf
- https://site-1036965.mozfiles.com/files/1036965/18789143087.pdf
- https://site-1038758.mozfiles.com/files/1038758/zosagikofagimoman.pdf
- https://pevugubak.weebly.com/uploads/1/3/2/7/132740457/vatozona.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/4056517.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/dekefomivupe-kovak-talajonipa-fedebiraroz.pdf
- https://uploads.strikinglycdn.com/files/f4862e42-1796-4548-bd80-777d61d13828/83888949255.pdf
- https://uploads.strikinglycdn.com/files/6ceb6d2d-60aa-475d-ae83-6b7b5d669d47/67936355738.pdf
- https://uploads.strikinglycdn.com/files/29f9a3b1-5090-4c4d-9788-6c638158ff7c/zuparomugibebovotazasuni.pdf
- https://uploads.strikinglycdn.com/files/5cc03702-012e-4f2a-9f4d-eb5724517ce1/serixeselufilexotoda.pdf
- https://uploads.strikinglycdn.com/files/5a770ffe-f465-48fc-93d8-41712152d5d9/vavekafofubab.pdf
- https://cdn-cms.f-static.net/uploads/4366311/normal_5f8716cd54e8f.pdf
- https://cdn-cms.f-static.net/uploads/4366358/normal_5f8722116a13a.pdf
- https://cdn-cms.f-static.net/uploads/4367622/normal_5f8754145492e.pdf
- https://site-1040142.mozfiles.com/files/1040142/42218447896.pdf
- https://site-1043686.mozfiles.com/files/1043686/18187850098.pdf
- https://site-1048184.mozfiles.com/files/1048184/zudebejaf.pdf
- https://site-1040665.mozfiles.com/files/1040665/96677724407.pdf
- https://site-1037902.mozfiles.com/files/1037902/remajagimokadivuruguwukil.pdf
- https://cdn-cms.f-static.net/uploads/4366357/normal_5f873aa2cc611.pdf
- https://cdn-cms.f-static.net/uploads/4365552/normal_5f8742ecbf5fb.pdf
- https://cdn-cms.f-static.net/uploads/4365598/normal_5f875a1dc5126.pdf
- https://cdn-cms.f-static.net/uploads/4366965/normal_5f873ce9ba8e8.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- gettraff.ru
- site-1042969.mozfiles.com
- site-1036965.mozfiles.com
- site-1038758.mozfiles.com
- pevugubak.weebly.com
- dutitujazekap.weebly.com
- zoxuzuxebexot.weebly.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- site-1040142.mozfiles.com
- site-1043686.mozfiles.com
- site-1048184.mozfiles.com
- site-1040665.mozfiles.com
- site-1037902.mozfiles.com
- www.w3.org
- purl.org
- 5mod.ru
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report