SUSPICIOUS — normal_5f9a8ff0f3069.pdf
SUSPICIOUS — normal_5f9a8ff0f3069.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
24a084fb4058106d7ef8f90f66bd17f82bff1115cd48414a5458aa61b5df2181 - SHA-1:
74fa5ad552d412e67aa49fd2a5e6508c71c430be - MD5:
7718fab06fcedc05f447e38a7474fa9b - ssdeep:
768:2gGzpDpnL3MFzrNk8BjgA91C9mVKQKQnhmLSlQwVIDjhfWDX7ZgxJC:jGFtnLYiA3iqBhTGDdWDX7ZgxJC - TLSH:
T125317DF31097EC8C3A8A8F43ADA6255920CAC74C71368A64458C7F3CD8BC6AD7E50D65 - Submitted as: normal_5f9a8ff0f3069.pdf
- File type: pdf · Size: 41947 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.cc/123?keyword=2002+nissan+xterra+factory+service+manual, https://cdn-cms.f-static.net/uploads/4369305/normal_5f93f70d9e411.pdf, https://kubupukadumu.weebly.com/uploads/1/3/1/3/131382740/c2bbd4cc16b88.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://ttraff.cc/123?keyword=2002+nissan+xterra+factory+service+manual
- https://cdn-cms.f-static.net/uploads/4369305/normal_5f93f70d9e411.pdf
- https://kubupukadumu.weebly.com/uploads/1/3/1/3/131382740/c2bbd4cc16b88.pdf
- https://cdn-cms.f-static.net/uploads/4408712/normal_5f92ef0d55794.pdf
- https://s3.amazonaws.com/varoximu/19843363455.pdf
- https://s3.amazonaws.com/setaxilitozuko/19869378830.pdf
- https://uploads.strikinglycdn.com/files/9797859a-b0fd-4bca-95f4-f9d2486a3c3e/kawoworosodogiti.pdf
- https://cdn-cms.f-static.net/uploads/4385437/normal_5f9638018cc06.pdf
- https://pinoxelu.weebly.com/uploads/1/3/4/1/134108818/7439684.pdf
- https://s3.amazonaws.com/batoragubukepo/gokagetibatolanerimami.pdf
- https://s3.amazonaws.com/wilugugo/risibadujexokusoloxatek.pdf
- https://bajumavo.weebly.com/uploads/1/3/4/4/134486103/jogaxoridoso-pepuwonigoz-divot.pdf
- https://talowitutujuf.weebly.com/uploads/1/3/3/9/133999148/wanidutomixibov_musuxujovexu_rivuxuxunanubo_fajerarididaba.pdf
- https://wozofawado.weebly.com/uploads/1/3/0/8/130874325/ruxufu.pdf
- https://cdn-cms.f-static.net/uploads/4388067/normal_5f90346c2368b.pdf
- https://uploads.strikinglycdn.com/files/fcc6f247-df6c-4553-9248-7bb19333d851/xugugalofimukoxo.pdf
- https://kusanogiwaxug.weebly.com/uploads/1/3/0/8/130873987/jukitugeze-lokirofobago-bizamuzeza-momiwagozuxu.pdf
- https://s3.amazonaws.com/fovezewi/42735963156.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/4045700.pdf
- https://s3.amazonaws.com/mamukawaxatali/vita_classical_shade_guide_hue.pdf
- https://sanuvexugivi.weebly.com/uploads/1/3/1/6/131606490/9b7c7cc1c04.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ttraff.cc
- cdn-cms.f-static.net
- kubupukadumu.weebly.com
- s3.amazonaws.com
- uploads.strikinglycdn.com
- pinoxelu.weebly.com
- bajumavo.weebly.com
- talowitutujuf.weebly.com
- wozofawado.weebly.com
- kusanogiwaxug.weebly.com
- zoxuzuxebexot.weebly.com
- sanuvexugivi.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report