SUSPICIOUS — normal_5f95bf3a2d238.pdf
SUSPICIOUS — normal_5f95bf3a2d238.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
4b4dd1ec8fac2b143ffb9e515830bf453b07cf5ab4adacdbf8dc05fc16cd26c3 - SHA-1:
f5c645a17b3c4714a9f839242d6bc300a405d227 - MD5:
8157a1908833c4dd0b9bd7d321b4f5ca - ssdeep:
768:cgGzpDbme9FZvTmRPp0jk67hNpgfmJkN21pMLuz8SXNnQWcGr0/Ywo+W7jrSq6Z7:5GF/meDZvweX8S+5wwo+I8XeEVPrI0VZ - TLSH:
T1A2337DF310EBEC8C7B8A9F13ADEB1059655EC74C6122A7A004C8772CC5BC6AD6E14A51 - Submitted as: normal_5f95bf3a2d238.pdf
- File type: pdf · Size: 48137 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/123?keyword=teach+yourself+beginner%2527s+urdu+script+pdf, https://cdn.shopify.com/s/files/1/0268/8447/3013/files/types_of_nouns_worksheet_for_class_4.pdf, https://cdn.shopify.com/s/files/1/0497/5978/1023/files/appropriate_prepositions_with_examples.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=teach+yourself+beginner%2527s+urdu+script+pdf
- https://cdn.shopify.com/s/files/1/0268/8447/3013/files/types_of_nouns_worksheet_for_class_4.pdf
- https://cdn.shopify.com/s/files/1/0497/5978/1023/files/appropriate_prepositions_with_examples.pdf
- https://cdn.shopify.com/s/files/1/0492/3041/3980/files/carros_de_control_remoto_4x4_carreras.pdf
- https://cdn.shopify.com/s/files/1/0496/0993/2949/files/36499491264.pdf
- https://cdn-cms.f-static.net/uploads/4365580/normal_5f873f04d3065.pdf
- https://cdn-cms.f-static.net/uploads/4412896/normal_5f95038e7c16c.pdf
- https://cdn-cms.f-static.net/uploads/4365545/normal_5f88fd27e7b27.pdf
- https://cdn-cms.f-static.net/uploads/4378404/normal_5f8c8b1745d95.pdf
- https://cdn-cms.f-static.net/uploads/4366045/normal_5f86fed07983d.pdf
- https://rinumobepora.weebly.com/uploads/1/3/4/3/134377952/mozowaxefujukavilur.pdf
- https://kurikezexiwu.weebly.com/uploads/1/3/0/7/130775092/pividis.pdf
- https://funiwulew.weebly.com/uploads/1/3/2/8/132814073/6930247.pdf
- https://cdn.shopify.com/s/files/1/0482/7588/2146/files/energy_management_handbook_turner.pdf
- https://cdn.shopify.com/s/files/1/0501/4539/4858/files/afterglow_controller_ps3_manual.pdf
- https://cdn.shopify.com/s/files/1/0266/9087/9667/files/injection_moulding_machine_types.pdf
- https://uploads.strikinglycdn.com/files/d78a93d1-5f49-46e0-be1d-46ec8eb421e7/nulifaze.pdf
- https://uploads.strikinglycdn.com/files/cd832d5e-7470-46ba-8f56-e8824346b6ca/zimofuziditotewaji.pdf
- https://uploads.strikinglycdn.com/files/6e9cd0dc-2dcd-48df-8863-97ac748eff7b/alex_becker_10_pillars_of_wealth.pdf
- https://uploads.strikinglycdn.com/files/828c44f2-322d-4f5e-b9ef-a5892c4ded25/zejojifemusulodigemaxawel.pdf
- https://uploads.strikinglycdn.com/files/82f824ba-82c4-4cfc-9b6d-3d68a7777c01/dogiselumiwobufume.pdf
- https://uploads.strikinglycdn.com/files/21bf09df-fd4d-4cb5-8fbd-1c099034a9d6/degimubojukogugeburox.pdf
- https://uploads.strikinglycdn.com/files/25f67f66-3de9-4db2-83e0-d6e2406854d9/movonuperevowasizipogem.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- cctraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- rinumobepora.weebly.com
- kurikezexiwu.weebly.com
- funiwulew.weebly.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report