SUSPICIOUS — normal_5f8a33aaf145a.pdf
SUSPICIOUS — normal_5f8a33aaf145a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
1d8a210ff5f0deb0a52fa698212a4d7d91451a136bb2386849df832f04058b74 - SHA-1:
c0b4ae2a828ec19897aba053a22bb8a9f36904c2 - MD5:
f48c9d1dff4f6cfe04e5fcee37c32125 - ssdeep:
768:gSgGzpD3eSgCVkIe6md5kmgcCrZAmt0YDNIikd33qKrrpnSYP+NXlPWYzo4c:gPGFjeSnTuYDNIi9zC+JlP3zo4c - TLSH:
T107329EF3A09BED8C7A879B136CA72164604EC74D6232ABA0549C7B2CD57C6FC6F10950 - Submitted as: normal_5f8a33aaf145a.pdf
- File type: pdf · Size: 46455 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=kels+assessment+form+pdf, https://fuparududewon.weebly.com/uploads/1/3/1/8/131856041/jubumirigop_genijijuris_wasezele.pdf, https://togitarusufojir.weebly.com/uploads/1/3/2/6/132681229/lakati.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=kels+assessment+form+pdf
- https://fuparududewon.weebly.com/uploads/1/3/1/8/131856041/jubumirigop_genijijuris_wasezele.pdf
- https://togitarusufojir.weebly.com/uploads/1/3/2/6/132681229/lakati.pdf
- https://gusumadanu.weebly.com/uploads/1/3/2/6/132695601/zakenu_wovanozezavibit.pdf
- https://fodezamu.weebly.com/uploads/1/3/1/4/131407453/1000608.pdf
- https://cdn-cms.f-static.net/uploads/4368243/normal_5f8839cd8bb6a.pdf
- https://cdn-cms.f-static.net/uploads/4365620/normal_5f87d47f33615.pdf
- https://cdn-cms.f-static.net/uploads/4366384/normal_5f8722932e1c6.pdf
- https://cdn-cms.f-static.net/uploads/4375194/normal_5f8999710e6cc.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f87fd399a315.pdf
- https://nurekagenarufab.weebly.com/uploads/1/3/1/6/131636906/gevanubuka.pdf
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/6023986.pdf
- https://cdn.shopify.com/s/files/1/0429/7038/2490/files/redwall_reddit.pdf
- https://cdn.shopify.com/s/files/1/0481/4680/8983/files/frases_de_desamor_para_hombres.pdf
- https://cdn.shopify.com/s/files/1/0496/7527/2349/files/square_and_cube_roots_worksheet_kuta.pdf
- https://cdn.shopify.com/s/files/1/0501/9903/6086/files/12817600403.pdf
- https://cdn.shopify.com/s/files/1/0484/8979/1643/files/atlas_copco_ga_37_plus_parts_manual.pdf
- https://cdn-cms.f-static.net/uploads/4367296/normal_5f877ca2ef72e.pdf
- https://cdn-cms.f-static.net/uploads/4365575/normal_5f87bf3a89cc6.pdf
- https://cdn-cms.f-static.net/uploads/4366029/normal_5f86f92abc543.pdf
- https://cdn-cms.f-static.net/uploads/4369149/normal_5f8883b520a62.pdf
- https://cdn-cms.f-static.net/uploads/4371787/normal_5f8a243b0d334.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ggtraff.ru
- fuparududewon.weebly.com
- togitarusufojir.weebly.com
- gusumadanu.weebly.com
- fodezamu.weebly.com
- cdn-cms.f-static.net
- nurekagenarufab.weebly.com
- genigudepa.weebly.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report