SUSPICIOUS — normal_5f873aa2cc611.pdf
SUSPICIOUS — normal_5f873aa2cc611.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
4bae4694215a91a108a3a6760a8c6895719c4724746bcf48880d16947338ed4b - SHA-1:
d17c95b38bb0b4961f81fbf8453296c37afb513a - MD5:
7f2031bd9cd53d06a17a6a28723aa243 - ssdeep:
768:egGzpD9p8DcTzWT6JeclT5qIo0J+Ano2GiuOZeRZqRkyyNZcJL531gFiYDmi5OnM:bGFpp8DAzW63tjnkcN91f8mW2qRnBD - TLSH:
T152337DF341A3EE4C768B6F0799AB1169908ED749712397A0448C7B2CD1BC6FE7E00A51 - Submitted as: normal_5f873aa2cc611.pdf
- File type: pdf · Size: 50559 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/d65badfd-aa83-4b22-a38e-33ddc9759c34/2625994295.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=banner+saga+3+heroic+titles+guide, https://site-1039481.mozfiles.com/files/1039481/sizuwajikod.pdf, https://site-1037188.mozfiles.com/files/1037188/6386594249.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=banner+saga+3+heroic+titles+guide
- https://site-1039481.mozfiles.com/files/1039481/sizuwajikod.pdf
- https://site-1037188.mozfiles.com/files/1037188/6386594249.pdf
- https://site-1043295.mozfiles.com/files/1043295/tatijizeguka.pdf
- https://site-1038547.mozfiles.com/files/1038547/dafabujinipoz.pdf
- https://uploads.strikinglycdn.com/files/74614ac0-05e4-4543-ab2e-cf6abaf8a14f/vebumumonerepav.pdf
- https://uploads.strikinglycdn.com/files/33290718-9a37-43fa-9b5d-d0171093f2fc/tolupusirutebeduxuxir.pdf
- https://uploads.strikinglycdn.com/files/5ed90f92-989f-482c-a04e-a545dfc566fb/84558293543.pdf
- https://uploads.strikinglycdn.com/files/d65badfd-aa83-4b22-a38e-33ddc9759c34/2625994295.pdf
- https://uploads.strikinglycdn.com/files/dd8895a1-74e1-4f2f-b43d-63a4945c5d51/20881824038.pdf
- https://cdn.shopify.com/s/files/1/0438/4532/0861/files/gizuvivawasarigofopirife.pdf
- https://cdn.shopify.com/s/files/1/0431/2449/0397/files/bawelipumopewiwoxomo.pdf
- https://cdn.shopify.com/s/files/1/0495/9233/6547/files/62135912845.pdf
- https://cdn.shopify.com/s/files/1/0482/3751/0817/files/300w_led_grow_light_lumens.pdf
- https://cdn.shopify.com/s/files/1/0433/2473/5643/files/84362489849.pdf
- https://cdn-cms.f-static.net/uploads/4366305/normal_5f872b822c684.pdf
- https://cdn-cms.f-static.net/uploads/4366661/normal_5f87263b1c4d8.pdf
- https://cdn-cms.f-static.net/uploads/4366040/normal_5f87198db5ef7.pdf
- https://cdn-cms.f-static.net/uploads/4365627/normal_5f870321509a4.pdf
- https://cdn-cms.f-static.net/uploads/4366033/normal_5f87082e9b1d7.pdf
- https://site-1039676.mozfiles.com/files/1039676/38922980666.pdf
- https://site-1042591.mozfiles.com/files/1042591/98936590510.pdf
- https://site-1041949.mozfiles.com/files/1041949/wopegobafizunalebagex.pdf
- https://site-1042938.mozfiles.com/files/1042938/tupigexupojafavaresu.pdf
- https://uploads.strikinglycdn.com/files/7b683eb0-a78d-494b-84f3-d38d6edf7f69/1981386713.pdf
Embedded domains
- ggtraff.ru
- site-1039481.mozfiles.com
- site-1037188.mozfiles.com
- site-1043295.mozfiles.com
- site-1038547.mozfiles.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- cdn-cms.f-static.net
- site-1039676.mozfiles.com
- site-1042591.mozfiles.com
- site-1041949.mozfiles.com
- site-1042938.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report