SUSPICIOUS — normal_5f9c9ad611066.pdf

SUSPICIOUS — normal_5f9c9ad611066.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 42efc30260ce9fffe0700dcec54118451fa9398e08fbba03ddc262909720d301
• SHA-1: 9f37b2efff71b7312b62aa7eaa956b2428de3452
• MD5: 1773e528b4b043b05266dbfde4c826dc
• ssdeep: 768:ZgGzpD6XTDWzk0ECl+5/5kTVTiuK+MR7Qz+psGLuynorAp9:aGFmjBnR5kZ+ujMFi+NL/norAp9
• TLSH: T126307DF75097DD8C6A8BEF139EAA109D248AD74C6022CA2444DC377CC4BC6BEBE50561
• Submitted as: normal_5f9c9ad611066.pdf
• File type: pdf · Size: 36070 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ttraff.ru/123?keyword=5+minutes+to+kill+yourself+airport, https://biwugina.weebly.com/uploads/1/3/1/1/131163984/646a6.pdf, https://cdn-cms.f-static.net/uploads/4418001/normal_5f995866846bb.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ttraff.ru/123?keyword=5+minutes+to+kill+yourself+airport
• https://biwugina.weebly.com/uploads/1/3/1/1/131163984/646a6.pdf
• https://cdn-cms.f-static.net/uploads/4418001/normal_5f995866846bb.pdf
• https://s3.amazonaws.com/vonusirukete/26342499390.pdf
• https://vekejuritikoj.weebly.com/uploads/1/3/1/8/131857631/lumurefimuwav-nalexo-fewajugakeka-ributesila.pdf
• https://wimejevufafej.weebly.com/uploads/1/3/4/3/134379448/68802abe22b1a.pdf
• https://cdn.shopify.com/s/files/1/0497/6669/5071/files/filgrastim_davis_drug_guide.pdf
• https://s3.amazonaws.com/kufazete/english_textbook_year_5_kssr_sjk.pdf
• https://cdn-cms.f-static.net/uploads/4375206/normal_5f8e0f695dbc2.pdf
• https://cdn.shopify.com/s/files/1/0496/2700/5094/files/perdue_chicken_patty_cooking_instructions.pdf
• https://s3.amazonaws.com/levovod/dituk.pdf
• https://s3.amazonaws.com/dogazisuze/riesgo_social_definicion.pdf
• https://naxedomabaxa.weebly.com/uploads/1/3/1/6/131606472/3049569.pdf
• https://s3.amazonaws.com/wonoti/wediz.pdf
• https://cdn-cms.f-static.net/uploads/4408475/normal_5f927725bc77e.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• biwugina.weebly.com
• cdn-cms.f-static.net
• s3.amazonaws.com
• vekejuritikoj.weebly.com
• wimejevufafej.weebly.com
• cdn.shopify.com
• naxedomabaxa.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report