SUSPICIOUS — normal_5f86fab078e3e.pdf

SUSPICIOUS — normal_5f86fab078e3e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 45d2464c1a4a72cd7a9541c1a8901f04de8dd37463d474f9d0c2f1da34fa1d2f
• SHA-1: 2080d333d511bfb5676f6533685498f8e9874664
• MD5: 2358642da9304699149a4ea8d22ec51f
• ssdeep: 768:wQgGzpDSpKdOtnbPzVy7oSz/nX+wftkwfl67+iAIRSKfM:EGFepoOhH+/X+w2wflaAIRSKfM
• TLSH: T1F031CFF76177ED8C7AC2AB03AEB511051286D78DB133966449987B2DC4BC2FCAE00931
• Submitted as: normal_5f86fab078e3e.pdf
• File type: pdf · Size: 42261 bytes
• Verdict: suspicious (44/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/123?keyword=find+stored+wifi+passwords+on+android, https://site-1038946.mozfiles.com/files/1038946/71088431876.pdf, https://site-1040769.mozfiles.com/files/1040769/degusilepolevakowaji.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/123?keyword=find+stored+wifi+passwords+on+android
• https://site-1038946.mozfiles.com/files/1038946/71088431876.pdf
• https://site-1040769.mozfiles.com/files/1040769/degusilepolevakowaji.pdf
• https://site-1043662.mozfiles.com/files/1043662/xeranuzezajutibem.pdf
• https://site-1039273.mozfiles.com/files/1039273/89759833110.pdf
• https://site-1039612.mozfiles.com/files/1039612/41338767138.pdf
• https://site-1036716.mozfiles.com/files/1036716/jekujogo.pdf
• https://site-1041286.mozfiles.com/files/1041286/8940892724.pdf
• https://cdn.shopify.com/s/files/1/0481/5237/9553/files/hall_of_the_mountain_king.pdf
• https://cdn.shopify.com/s/files/1/0482/5297/7313/files/zesifosozenonelonivebo.pdf
• https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/kedoxezezaj-temolej-zunemalavorun-mutelokowomimi.pdf
• https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/domovodibaposix.pdf
• https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/belapigojat.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• site-1038946.mozfiles.com
• site-1040769.mozfiles.com
• site-1043662.mozfiles.com
• site-1039273.mozfiles.com
• site-1039612.mozfiles.com
• site-1036716.mozfiles.com
• site-1041286.mozfiles.com
• cdn.shopify.com
• guwomenod.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report