SUSPICIOUS — normal_5f87583a7c8d4.pdf
SUSPICIOUS — normal_5f87583a7c8d4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
26e940606d0083b58fbe7e3779bc0101dbe00c291f2ad3b19ae6bb0cd7c92ca3 - SHA-1:
be6d7f09c232df95040c0d87d85151d73345c14d - MD5:
73f1856f819d977e37af86c9d61a14ef - ssdeep:
768:egGzpDpp2Lc7NWYUIMXYZAl4KpIB2rAkn67nPmbETgNFkeaG4jYHUbbYVRmobFx/:bGFVpQ+SQQaRYnVRXFzj4pkPgEVr - TLSH:
T18B338CF30097ED8C7683EF57A9AB246EA149E7896222E76055C8173CD57C77CBE10A00 - Submitted as: normal_5f87583a7c8d4.pdf
- File type: pdf · Size: 49338 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=download+data%252Bapk+gta+sa+lite+gpu+adreno, https://cdn.shopify.com/s/files/1/0482/7794/6526/files/swing_speed_radar.pdf, https://cdn.shopify.com/s/files/1/0496/1838/7097/files/sunsetter_awning_cover_recall.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=download+data%252Bapk+gta+sa+lite+gpu+adreno
- https://cdn.shopify.com/s/files/1/0482/7794/6526/files/swing_speed_radar.pdf
- https://cdn.shopify.com/s/files/1/0496/1838/7097/files/sunsetter_awning_cover_recall.pdf
- https://cdn.shopify.com/s/files/1/0439/3297/5272/files/decreto_1295_de_1994_resumen.pdf
- https://cdn.shopify.com/s/files/1/0428/6454/1852/files/heathkit_sb_101_schematic.pdf
- https://cdn.shopify.com/s/files/1/0430/7589/5447/files/jezarisoxewijelineside.pdf
- https://cdn.shopify.com/s/files/1/0500/5531/5614/files/gta_san_andreas_cheats_apkpure.pdf
- https://cdn.shopify.com/s/files/1/0484/2730/3069/files/eastwood_mig_135_amazon.pdf
- https://cdn.shopify.com/s/files/1/0501/1380/6486/files/5002777289.pdf
- https://cdn.shopify.com/s/files/1/0266/9314/0664/files/10607842863.pdf
- https://cdn.shopify.com/s/files/1/0438/6547/3189/files/bandai_1_144_millennium_falcon_uk.pdf
- https://cdn.shopify.com/s/files/1/0495/8794/5622/files/87999236266.pdf
- https://cdn.shopify.com/s/files/1/0496/1746/9604/files/rebuzaparudorijaletadesi.pdf
- https://cdn.shopify.com/s/files/1/0428/2623/6071/files/five_languages_of_apology.pdf
- https://site-1038981.mozfiles.com/files/1038981/51494495901.pdf
- https://site-1043249.mozfiles.com/files/1043249/jesugu.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f87461f4b24d.pdf
- https://cdn-cms.f-static.net/uploads/4366395/normal_5f871ce08b9be.pdf
- https://cdn-cms.f-static.net/uploads/4367286/normal_5f875724d9e3f.pdf
- https://cdn.shopify.com/s/files/1/0438/6386/7552/files/zuroliloxojil.pdf
- https://cdn.shopify.com/s/files/1/0497/8488/1301/files/sivonebafokadudesobur.pdf
- https://cdn.shopify.com/s/files/1/0432/5651/2667/files/nutrisystem_kits_in_stores.pdf
- https://cdn.shopify.com/s/files/1/0436/0306/7038/files/watch_black_widow_2010_online_free.pdf
- https://cdn.shopify.com/s/files/1/0483/8640/8599/files/57813326618.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- site-1038981.mozfiles.com
- site-1043249.mozfiles.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report