SUSPICIOUS — normal_5f876c1de15bf.pdf
SUSPICIOUS — normal_5f876c1de15bf.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
2c285a69a32166e6150b74f9437666bcd2f9cfd10d39f662b3ffde83d972e057 - SHA-1:
deb88cfebdfe09af25d5cb8f8acf449f3e0868d5 - MD5:
e891635fce8f922531e76ea97ea45a1c - ssdeep:
768:ugGzpD2pt/x8Vm8QwXlA/o+bi7VbPZlvX3GpAj7sKr0OV7Qfoyi4ZUk73Kl71Y8G:LGFiptJ8NQyf0OxyHZjTc4xT - TLSH:
T1A7338DF310A7DC8C7A879B03ADAB345E954DE7899132AB609448673DC27C73D3E50A60 - Submitted as: normal_5f876c1de15bf.pdf
- File type: pdf · Size: 49328 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/e8435afd-e8ac-45ce-8ccb-ced17f42f2b4/woxanose.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/123?keyword=stihl+chainsaw+sharpening+roller+guide, https://uploads.strikinglycdn.com/files/0d26c9f4-4ec7-4343-80d8-80bd98736a8f/56839696193.pdf, https://uploads.strikinglycdn.com/files/8f017900-27e7-4d49-92d3-1ec26447c39f/68028618036.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/123?keyword=stihl+chainsaw+sharpening+roller+guide
- https://uploads.strikinglycdn.com/files/0d26c9f4-4ec7-4343-80d8-80bd98736a8f/56839696193.pdf
- https://uploads.strikinglycdn.com/files/8f017900-27e7-4d49-92d3-1ec26447c39f/68028618036.pdf
- https://uploads.strikinglycdn.com/files/e8435afd-e8ac-45ce-8ccb-ced17f42f2b4/woxanose.pdf
- https://cdn.shopify.com/s/files/1/0478/7978/2566/files/summit_county_parcel_search_map.pdf
- https://cdn.shopify.com/s/files/1/0488/4784/7589/files/audio_fx_apk_android_10.pdf
- https://cdn.shopify.com/s/files/1/0494/5841/3735/files/69044473715.pdf
- https://cdn.shopify.com/s/files/1/0494/7076/7271/files/wijunamig.pdf
- https://cdn-cms.f-static.net/uploads/4366027/normal_5f87684211a6d.pdf
- https://cdn-cms.f-static.net/uploads/4365582/normal_5f87080c982b7.pdf
- https://cdn-cms.f-static.net/uploads/4365634/normal_5f8730e55dba1.pdf
- https://cdn-cms.f-static.net/uploads/4365634/normal_5f8766dc444fb.pdf
- https://cdn-cms.f-static.net/uploads/4366381/normal_5f874b6221b9c.pdf
- https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/zakeme.pdf
- https://mojenosude.weebly.com/uploads/1/3/1/3/131382274/3837160.pdf
- https://nobinetezo.weebly.com/uploads/1/3/0/9/130969761/6b3d598.pdf
- https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/porukofosu.pdf
- https://vopevejefed.weebly.com/uploads/1/3/1/6/131606133/vovapoxupileve_roxemav.pdf
- https://site-1037265.mozfiles.com/files/1037265/powirowanisezo.pdf
- https://site-1040363.mozfiles.com/files/1040363/8348075207.pdf
- https://site-1043172.mozfiles.com/files/1043172/62257609359.pdf
- https://cdn.shopify.com/s/files/1/0437/9095/8749/files/rujugix.pdf
- https://cdn.shopify.com/s/files/1/0433/2689/8344/files/vukozoxowibilokobidipalo.pdf
- https://cdn.shopify.com/s/files/1/0482/8990/6852/files/84748404582.pdf
- https://cdn.shopify.com/s/files/1/0483/8929/2184/files/harmony_science_academy_dallas_jobs.pdf
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- cdn-cms.f-static.net
- dimaxafazeza.weebly.com
- mojenosude.weebly.com
- nobinetezo.weebly.com
- vopevejefed.weebly.com
- site-1037265.mozfiles.com
- site-1040363.mozfiles.com
- site-1043172.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report