SUSPICIOUS — on_parmak_klavye_dersleri.pdf
SUSPICIOUS — on_parmak_klavye_dersleri.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
54c614267a46c8337cedf56cd70ae3dcf29ee0d1ef8c4c7bb9212f62ae40dcfe - SHA-1:
d534077be316267bf38406646274f7cca49822e9 - MD5:
b0e9239246948790c9d1c95f3b841321 - ssdeep:
768:jgGzpDAp4Tpvtgjz2N0Q0J3rgNkVZhbvn77UqwnCmtbHzPkXwc5EQzG7sa1QWgJD:cGFEpOOVAqwnLtbzPIwc5E57sauWgJ3z - TLSH:
T1DE329DF3209BED0C3A879B53ACBB0599704997887237D79019CC6A6CD4BC6AD7F10960 - Submitted as: on_parmak_klavye_dersleri.pdf
- File type: pdf · Size: 43677 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/strik?keyword=on+parmak+klavye+dersleri, https://cdn-cms.f-static.net/uploads/4380384/normal_5f8cb1dedf83b.pdf, https://cdn-cms.f-static.net/uploads/4370264/normal_5f893a4c0110d.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/strik?keyword=on+parmak+klavye+dersleri
- https://cdn-cms.f-static.net/uploads/4380384/normal_5f8cb1dedf83b.pdf
- https://cdn-cms.f-static.net/uploads/4370264/normal_5f893a4c0110d.pdf
- https://cdn-cms.f-static.net/uploads/4366042/normal_5f88a940a8d69.pdf
- https://cdn-cms.f-static.net/uploads/4365599/normal_5f878653eaf1b.pdf
- https://cdn.shopify.com/s/files/1/0481/6322/5767/files/guwugewuzimaka.pdf
- https://cdn.shopify.com/s/files/1/0436/2282/6144/files/99219297947.pdf
- https://cdn-cms.f-static.net/uploads/4365545/normal_5f8cb7cf738d3.pdf
- https://cdn-cms.f-static.net/uploads/4367004/normal_5f89c4e87ef9e.pdf
- https://cdn-cms.f-static.net/uploads/4374024/normal_5f8b66a142092.pdf
- https://cdn-cms.f-static.net/uploads/4385427/normal_5f8e3b2b2d0c1.pdf
- https://cdn-cms.f-static.net/uploads/4372983/normal_5f8fcf68b9744.pdf
- https://cdn-cms.f-static.net/uploads/4381737/normal_5f90b96cc85b2.pdf
- https://cdn-cms.f-static.net/uploads/4385207/normal_5f90bc76e3660.pdf
- https://cdn-cms.f-static.net/uploads/4368760/normal_5f889ad7791f8.pdf
- https://cdn-cms.f-static.net/uploads/4370088/normal_5f8bd7f1bb544.pdf
- https://cdn-cms.f-static.net/uploads/4383681/normal_5f8fbbba361d5.pdf
- https://cdn-cms.f-static.net/uploads/4366003/normal_5f873136acca0.pdf
- https://cdn-cms.f-static.net/uploads/4402707/normal_5f90fb94a3881.pdf
- https://cdn-cms.f-static.net/uploads/4391623/normal_5f90c87bb9152.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report