SUSPICIOUS — normal_5f882e89d629e.pdf
SUSPICIOUS — normal_5f882e89d629e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
334a57936a226865c4ebef12fbae487ea7ce534b38efa36c17c1152f8ab1a431 - SHA-1:
9c436ecb945c8811b5cf9724097d86161491fd53 - MD5:
dd6f5b52ba15e05b326496dcb64b68b8 - ssdeep:
768:XgGzpDapK0ZV1qIr3qQUKweWDgvsxN3zEwVkK1v9EyLWGAm4o3yq:wGF2p/Pweg2CdzEQf1lnLWGJ4o3yq - TLSH:
T1FD328DF310A7EE4C7A8B5B43ACE615A9508DC78CB23397605488772D887C6BD6F84461 - Submitted as: normal_5f882e89d629e.pdf
- File type: pdf · Size: 46720 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=el+apocrifo+de+juan+pdf, https://cdn-cms.f-static.net/uploads/4368732/normal_5f87a8ee44510.pdf, https://cdn-cms.f-static.net/uploads/4366366/normal_5f8711fa43455.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://gettraff.ru/123?keyword=el+apocrifo+de+juan+pdf
- https://cdn-cms.f-static.net/uploads/4368732/normal_5f87a8ee44510.pdf
- https://cdn-cms.f-static.net/uploads/4366366/normal_5f8711fa43455.pdf
- https://cdn-cms.f-static.net/uploads/4365626/normal_5f8746c1096a2.pdf
- https://cdn-cms.f-static.net/uploads/4367286/normal_5f8749a2bba8e.pdf
- https://cdn-cms.f-static.net/uploads/4367281/normal_5f87cfb1b8e1e.pdf
- https://site-1039289.mozfiles.com/files/1039289/17763004454.pdf
- https://site-1039167.mozfiles.com/files/1039167/kudab.pdf
- https://site-1042444.mozfiles.com/files/1042444/63940109917.pdf
- https://site-1041583.mozfiles.com/files/1041583/digulaxivez.pdf
- https://site-1036761.mozfiles.com/files/1036761/sapar.pdf
- https://site-1040363.mozfiles.com/files/1040363/domeroze.pdf
- https://site-1043893.mozfiles.com/files/1043893/4257664871.pdf
- https://site-1036632.mozfiles.com/files/1036632/lepinugivedeni.pdf
- https://site-1043620.mozfiles.com/files/1043620/19128845207.pdf
- https://site-1038765.mozfiles.com/files/1038765/37257101274.pdf
- https://cdn-cms.f-static.net/uploads/4368953/normal_5f87d69a4c287.pdf
- https://cdn-cms.f-static.net/uploads/4368219/normal_5f87ce8458889.pdf
- https://uploads.strikinglycdn.com/files/4df9c0dc-507c-4df2-810b-46744cf5a7c3/84941726236.pdf
- https://uploads.strikinglycdn.com/files/3d47c159-5e68-4e27-ad4c-f21d072c7999/15029150369.pdf
- https://uploads.strikinglycdn.com/files/ba775be1-d6c8-4f8b-bcc5-70e358b144c1/pezatibosekodokatovogupi.pdf
- https://uploads.strikinglycdn.com/files/a1e80a8c-73cc-44f5-8691-c015c841026d/bedupaz.pdf
- https://uploads.strikinglycdn.com/files/c5e9f9b2-87c2-472d-963a-a26372509819/23705309414.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- site-1039289.mozfiles.com
- site-1039167.mozfiles.com
- site-1042444.mozfiles.com
- site-1041583.mozfiles.com
- site-1036761.mozfiles.com
- site-1040363.mozfiles.com
- site-1043893.mozfiles.com
- site-1036632.mozfiles.com
- site-1043620.mozfiles.com
- site-1038765.mozfiles.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report