SUSPICIOUS — normal_5f9c532f34809.pdf

SUSPICIOUS — normal_5f9c532f34809.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 38017393cea6c46644db3e2e6bfdf0c4d86cf1b0b441fe4702da4cd14f6d0297
• SHA-1: 60dbfdbf08be70cf57e32da9d03b098f302e9e2e
• MD5: b9b2905a3feac48ad1f535cc09bb6c3a
• ssdeep: 768:dgGzpDT2t9JLPVpYY/AnUYuRloEBIpY6zzLvJE8V5shtoj6UFOXUoDraXc3P:eGFfW/LPLX/KE8V5At8QraXc3P
• TLSH: T140319EF3506BEC8DB986AF03BDE6006A144CD7893132EA6114DC7B6CC1BC6BD6E11961
• Submitted as: normal_5f9c532f34809.pdf
• File type: pdf · Size: 42849 bytes
• Verdict: suspicious (44/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ttraff.me/123?keyword=lego+death+star+escape, https://cdn.shopify.com/s/files/1/0499/6716/9689/files/85310133457.pdf, https://cdn-cms.f-static.net/uploads/4392218/normal_5f9be40815922.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/123?keyword=lego+death+star+escape
• https://cdn.shopify.com/s/files/1/0499/6716/9689/files/85310133457.pdf
• https://cdn-cms.f-static.net/uploads/4392218/normal_5f9be40815922.pdf
• https://cdn.shopify.com/s/files/1/0483/5799/8743/files/my_browser_is_not_working_android.pdf
• https://cdn.shopify.com/s/files/1/0494/2820/1639/files/9715697504.pdf
• https://cdn-cms.f-static.net/uploads/4391037/normal_5f99192dc1ae2.pdf
• https://cdn.shopify.com/s/files/1/0268/8430/9166/files/nefitupux.pdf
• https://cdn.shopify.com/s/files/1/0503/4046/2789/files/santa_teresa_nm_zip_code.pdf
• https://cdn.shopify.com/s/files/1/0503/6379/3576/files/niviroz.pdf
• https://cdn.shopify.com/s/files/1/0266/9579/4857/files/savatunevupi.pdf
• https://cdn.shopify.com/s/files/1/0498/8121/9226/files/french_alphabet_song_military_style.pdf
• https://cdn.shopify.com/s/files/1/0482/5451/7410/files/export_sim_contacts_from_iphone_to_android.pdf
• https://cdn.shopify.com/s/files/1/0504/2454/5430/files/crack_netflix_android_tv.pdf
• https://cdn.shopify.com/s/files/1/0509/4231/2635/files/pofosu.pdf
• https://cdn.shopify.com/s/files/1/0501/7603/2946/files/android_rooting_app_for_mac.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report