SUSPICIOUS — normal_5f8988e9caa97.pdf
SUSPICIOUS — normal_5f8988e9caa97.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
30f837fd118a63889cacead90be5bc13886d6835bcc36c8fe2f64ab58a247ade - SHA-1:
759b58c1fab4344f2433305e8bca749a8228416d - MD5:
7bc2c6139442df4d4825a9ab37dae496 - ssdeep:
768:vgGzpDxpZvbDwpHXXPY9I2wdAgn07gwhf8wrN4nmJ795zTNSBsWIPC9fqORc0hFd:YGFFpZvfnoQgwCwrN4nmJ79lTisW1fqE - TLSH:
T1B0338EF36087EE4C768BBF13AEAA11599146838D6232D79404C8775CC4BC7FD6E10A25 - Submitted as: normal_5f8988e9caa97.pdf
- File type: pdf · Size: 47989 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.link/123?keyword=el+bullying+y+sus+consecuencias+pdf, https://uploads.strikinglycdn.com/files/5b7035f1-f4ea-4ff0-9d35-28bd7a11caa8/8347757644.pdf, https://uploads.strikinglycdn.com/files/d5ddbd6a-1fb8-4024-818f-4f88b85f0d64/69058783569.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.link/123?keyword=el+bullying+y+sus+consecuencias+pdf
- https://uploads.strikinglycdn.com/files/5b7035f1-f4ea-4ff0-9d35-28bd7a11caa8/8347757644.pdf
- https://uploads.strikinglycdn.com/files/d5ddbd6a-1fb8-4024-818f-4f88b85f0d64/69058783569.pdf
- https://uploads.strikinglycdn.com/files/c847c44e-6d53-4b4f-83b7-90409d5d7d9a/91757420213.pdf
- https://cdn.shopify.com/s/files/1/0432/0509/9675/files/section_35-1_human_body_systems_pages_891-896_answers.pdf
- https://cdn.shopify.com/s/files/1/0499/3561/4120/files/cpcc_harper_campus_phone_number.pdf
- https://cdn.shopify.com/s/files/1/0482/1070/6619/files/decimal_word_problems_year_5_worksheets.pdf
- https://uploads.strikinglycdn.com/files/fc661d15-1923-44ab-80b4-3b7f9ede5bf6/tilixepiduzuvagitox.pdf
- https://uploads.strikinglycdn.com/files/135027aa-fb6c-4e74-85ab-ed00aea90841/pinurobomidomizexuvevi.pdf
- https://cdn-cms.f-static.net/uploads/4366365/normal_5f87afe442dc4.pdf
- https://cdn-cms.f-static.net/uploads/4372740/normal_5f89435cc7f26.pdf
- https://cdn-cms.f-static.net/uploads/4374520/normal_5f890fe8a0b04.pdf
- https://cdn-cms.f-static.net/uploads/4366357/normal_5f872395cc311.pdf
- https://cdn-cms.f-static.net/uploads/4366360/normal_5f896b715c781.pdf
- https://uploads.strikinglycdn.com/files/4a5259d2-5d8b-4981-a485-4169a3269f01/litubul.pdf
- https://uploads.strikinglycdn.com/files/76f05f0e-4beb-4889-ae6e-2631d942ff98/63683177820.pdf
- https://cdn-cms.f-static.net/uploads/4365580/normal_5f876506ce5f4.pdf
- https://cdn-cms.f-static.net/uploads/4365652/normal_5f87091560788.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.link
- uploads.strikinglycdn.com
- cdn.shopify.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report