SUSPICIOUS — normal_5f876e1b05215.pdf
SUSPICIOUS — normal_5f876e1b05215.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
22ca05a5ea922f97b3522e8f0674e440abb6ec27b1d538b63cc426e29daaddf4 - SHA-1:
bfd18cbf608d57d0e6abfa0278288057b38ef6f0 - MD5:
343ec0ce102a9c93b0aea927698128d4 - ssdeep:
768:ufgGzpDjpO/1SKHUXBsSX+OUxVreUxL5SKW6K0LtRHwOG3YAkQde4IBczA+208s/:/GFfp4eEq0LtRHw7YAkCe4IB+M08s/ - TLSH:
T1AA339DF7649BDD0D7A879703ADE62469608DC78C6132CBA0098C7B5CD5BC6BD3E10921 - Submitted as: normal_5f876e1b05215.pdf
- File type: pdf · Size: 48235 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://cdn-cms.f-static.net/uploads/4367013/normal_5f87461f9de24.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/123?keyword=turbo+vpn+app+for+android, https://cdn.shopify.com/s/files/1/0431/8366/9412/files/adrian_r3_school_calendar.pdf, https://cdn.shopify.com/s/files/1/0268/8899/5007/files/graphing_rational_functions_worksheet_answers.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=turbo+vpn+app+for+android
- https://cdn.shopify.com/s/files/1/0431/8366/9412/files/adrian_r3_school_calendar.pdf
- https://cdn.shopify.com/s/files/1/0268/8899/5007/files/graphing_rational_functions_worksheet_answers.pdf
- https://cdn.shopify.com/s/files/1/0499/3299/2674/files/apk_premium_gratis.pdf
- https://cdn.shopify.com/s/files/1/0441/1670/5432/files/54357360943.pdf
- https://cdn.shopify.com/s/files/1/0496/2667/7399/files/91868572736.pdf
- https://cdn.shopify.com/s/files/1/0498/0801/5513/files/1956_dodge_truck_wheelbase.pdf
- https://cdn-cms.f-static.net/uploads/4365598/normal_5f874f7a3afaf.pdf
- https://cdn-cms.f-static.net/uploads/4367013/normal_5f87461f9de24.pdf
- https://cdn-cms.f-static.net/uploads/4365589/normal_5f871f7c22653.pdf
- https://cdn-cms.f-static.net/uploads/4365540/normal_5f875b9fc3c24.pdf
- https://cdn-cms.f-static.net/uploads/4366381/normal_5f876cc4e1c9f.pdf
- https://cdn-cms.f-static.net/uploads/4365563/normal_5f876df64dc15.pdf
- https://cdn-cms.f-static.net/uploads/4366982/normal_5f8745089e237.pdf
- https://cdn-cms.f-static.net/uploads/4366000/normal_5f876cb57ef43.pdf
- https://uploads.strikinglycdn.com/files/8db0a52f-542e-4aac-8fb1-750d4c69421d/pijik.pdf
- https://uploads.strikinglycdn.com/files/eeb3322f-7b3e-4f32-a692-fe1dfe76e1d4/28689476342.pdf
- https://uploads.strikinglycdn.com/files/e636f843-646f-471f-b5be-983ba5d113e4/33890120058.pdf
- https://uploads.strikinglycdn.com/files/e97a8bf7-0b31-430e-8188-22ac6896c252/73192728480.pdf
- https://uploads.strikinglycdn.com/files/ebe8c622-ab07-4ddb-9199-fd6e4a40231e/58976354505.pdf
- https://uploads.strikinglycdn.com/files/caca7839-3b52-4c66-b6dc-06b1cdc99dda/tuxiga.pdf
- https://uploads.strikinglycdn.com/files/1ef510e8-274e-4a95-8e31-7c57516d9912/14161770751.pdf
- https://uploads.strikinglycdn.com/files/eff4901a-e95c-4383-adbb-f7fe4119e326/46440136523.pdf
- https://uploads.strikinglycdn.com/files/b8777db9-6508-4bb4-9f6b-44a95ae7a080/90959760589.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report