SUSPICIOUS — normal_5f90fc790ee6b.pdf
SUSPICIOUS — normal_5f90fc790ee6b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
343cc9fa2854fc7220d118a39c4e4ea694b91be5f849aeed46c44d08ec29c9a6 - SHA-1:
5a3ed556ec8d17e1abeaba19bfa6499ebbb04ab7 - MD5:
00d08a600de62abcc07e9ad32d62cf20 - ssdeep:
768:kqhgGzpD6p6FR6DAq0OsdPrUok3bq+Fz7v8v+0YLlG2p5N:cGF2paR6DDF8vBYLlPp5N - TLSH:
T170327BF350ABED1C7AC29F076EAA352D9449D788A137976044DC772CC0BC6BD6E40A20 - Submitted as: normal_5f90fc790ee6b.pdf
- File type: pdf · Size: 44596 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.ru/123?keyword=best+slow+motion+app+for+android+2020, https://cdn-cms.f-static.net/uploads/4379362/normal_5f90f442218eb.pdf, https://cdn-cms.f-static.net/uploads/4369138/normal_5f8b193bed27f.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://ttraff.ru/123?keyword=best+slow+motion+app+for+android+2020
- https://cdn-cms.f-static.net/uploads/4379362/normal_5f90f442218eb.pdf
- https://cdn-cms.f-static.net/uploads/4369138/normal_5f8b193bed27f.pdf
- https://cdn-cms.f-static.net/uploads/4365653/normal_5f8711e2f17c2.pdf
- https://uploads.strikinglycdn.com/files/76af5368-1977-476b-b755-3a44325583ec/ark_ragnarok_giga_spawns.pdf
- https://uploads.strikinglycdn.com/files/343708e9-e287-411a-bc87-0876db04387d/98384882818.pdf
- https://uploads.strikinglycdn.com/files/65b7fda1-fb3e-49b4-b581-7b900c26a49f/jadoniwuropaduduxexomubi.pdf
- https://uploads.strikinglycdn.com/files/edea6e4d-7153-44a8-85b4-cb3d16f5b590/exercice_principe_dinertie_seconde.pdf
- https://s3.amazonaws.com/wilugugo/99798323938.pdf
- https://s3.amazonaws.com/leguvefu/tactics_for_listening_developing_script.pdf
- https://s3.amazonaws.com/xipavir/17112565968.pdf
- https://s3.amazonaws.com/wizidimawag/regulation_of_carbohydrate_metabolism.pdf
- https://s3.amazonaws.com/henghuili-files/51034580680.pdf
- https://s3.amazonaws.com/henghuili-files/carnot_vapour_power_cycle.pdf
- https://s3.amazonaws.com/fasanag/xudovilidu.pdf
- https://s3.amazonaws.com/susopuzupure/doterra_on_guard_beadlet.pdf
- https://uploads.strikinglycdn.com/files/54661338-c8b9-4c4e-b3cd-fb8cf43dd7f2/42618733159.pdf
- https://uploads.strikinglycdn.com/files/490e3f50-10c0-4679-a557-e89565fed3af/graham_hancock_tedx_dmt.pdf
- https://uploads.strikinglycdn.com/files/4f5feffd-9214-4538-be2e-0b0b97532533/jofoxivulotigozuposulel.pdf
- https://cdn-cms.f-static.net/uploads/4373271/normal_5f9008eb9a1f1.pdf
- https://cdn-cms.f-static.net/uploads/4378831/normal_5f8c1dc946016.pdf
- https://cdn-cms.f-static.net/uploads/4383915/normal_5f8d611784ac3.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ttraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report