SUSPICIOUS — normal_5f87847ed2f6d.pdf
SUSPICIOUS — normal_5f87847ed2f6d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
20a521fd7f8ef3c6fd16d3dcf8f576736d8a1a4894c1e65a63df5ca79a8a6c34 - SHA-1:
b11a991abc0bce33c22d671c24cd816cd031dac6 - MD5:
352985c263404b03e6bb8afa6c2eec18 - ssdeep:
1536:xGFcp6MekG1esr0bj9pQP0sVxzmi1y5Z+FdJCJ2yAlyK:UFcpyk7J9pQPzxzhyr+FHyAV - TLSH:
T1FB35BFF360A7ED4C7A8F5B077D9621A9B186C7CD613293A044C8332DD4B87ED2E11A61 - Submitted as: normal_5f87847ed2f6d.pdf
- File type: pdf · Size: 59352 bytes
- Verdict: suspicious (44/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/123?keyword=jeep+grand+cherokee+limited+2020+owners+manual, https://cdn-cms.f-static.net/uploads/4366029/normal_5f87796d011c5.pdf, https://cdn-cms.f-static.net/uploads/4366987/normal_5f876a8424d34.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=jeep+grand+cherokee+limited+2020+owners+manual
- https://cdn-cms.f-static.net/uploads/4366029/normal_5f87796d011c5.pdf
- https://cdn-cms.f-static.net/uploads/4366987/normal_5f876a8424d34.pdf
- https://cdn-cms.f-static.net/uploads/4366319/normal_5f87811f67004.pdf
- https://cdn-cms.f-static.net/uploads/4366362/normal_5f873720ab74f.pdf
- https://cdn-cms.f-static.net/uploads/4365599/normal_5f872f1b3bcd1.pdf
- https://cdn-cms.f-static.net/uploads/4366401/normal_5f872a24db259.pdf
- https://cdn-cms.f-static.net/uploads/4366958/normal_5f87664abbbc2.pdf
- https://site-1037849.mozfiles.com/files/1037849/33025396744.pdf
- https://site-1040042.mozfiles.com/files/1040042/tobimowuj.pdf
- https://site-1044020.mozfiles.com/files/1044020/22695391755.pdf
- https://site-1036798.mozfiles.com/files/1036798/fawidawobelekora.pdf
- https://cdn-cms.f-static.net/uploads/4365539/normal_5f877933c0c16.pdf
- https://cdn-cms.f-static.net/uploads/4367007/normal_5f877eef3fda3.pdf
- https://cdn-cms.f-static.net/uploads/4366660/normal_5f8770de850d4.pdf
- https://cdn-cms.f-static.net/uploads/4366350/normal_5f8714fec4854.pdf
- https://cdn-cms.f-static.net/uploads/4366022/normal_5f871fea94e85.pdf
- https://cdn-cms.f-static.net/uploads/4365602/normal_5f8776b5822f3.pdf
- https://cdn-cms.f-static.net/uploads/4366358/normal_5f873cd626ae1.pdf
- https://cdn-cms.f-static.net/uploads/4368487/normal_5f8774d5b33cd.pdf
- https://cdn-cms.f-static.net/uploads/4366987/normal_5f877412c5f26.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- site-1037849.mozfiles.com
- site-1040042.mozfiles.com
- site-1044020.mozfiles.com
- site-1036798.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report