SUSPICIOUS — normal_5f9a2b54e4b2f.pdf
SUSPICIOUS — normal_5f9a2b54e4b2f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
59a5123d81c7a26034aaa2aa6acd57c1a6ee00826facdac794cf4270a91b0636 - SHA-1:
4debc1ee32c2efc89756cf0db3bd363999a19901 - MD5:
dc7e40240451c95c007c36440f0f62df - ssdeep:
768:NgGzpDwbTwjfDX+91YA+BIdBFxcFHcP4/K+VkDVAnd626rGr1An1T4CS/5T:uGFkbVvxyNkDCmGrEcJ/5T - TLSH:
T19B315CF35197ED4C3A879F03ADAA289D65C9C39C6172D360889C6B2DC87C3AD7E10851 - Submitted as: normal_5f9a2b54e4b2f.pdf
- File type: pdf · Size: 40476 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.ru/123?keyword=railroad+symbols+on+a+map, https://cdn-cms.f-static.net/uploads/4404730/normal_5f9189bfaccfb.pdf, https://cdn.shopify.com/s/files/1/0428/8331/7926/files/5701737342.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.ru/123?keyword=railroad+symbols+on+a+map
- https://cdn-cms.f-static.net/uploads/4404730/normal_5f9189bfaccfb.pdf
- https://cdn.shopify.com/s/files/1/0428/8331/7926/files/5701737342.pdf
- https://uploads.strikinglycdn.com/files/59719701-74fd-4297-8606-4fbc13652a8c/60920751954.pdf
- https://uploads.strikinglycdn.com/files/926e6945-a6c6-4493-9230-8b4f4833000e/army_men_strike_cheats.pdf
- https://cdn.shopify.com/s/files/1/0431/2639/0946/files/rerawomafasexusix.pdf
- https://cdn-cms.f-static.net/uploads/4369153/normal_5f88293c9f3fb.pdf
- https://uploads.strikinglycdn.com/files/cfab9197-621b-432f-ad73-9d2a547319d1/mitudu.pdf
- https://cdn-cms.f-static.net/uploads/4392853/normal_5f8ff025df37a.pdf
- https://cdn-cms.f-static.net/uploads/4371787/normal_5f948b671f79e.pdf
- https://cdn.shopify.com/s/files/1/0486/0565/9296/files/13_colonies_reading_comprehension_worksheet.pdf
- https://cdn-cms.f-static.net/uploads/4408594/normal_5f93974137cd5.pdf
- https://cdn.shopify.com/s/files/1/0497/3513/9487/files/download_free_ke_word.pdf
- https://uploads.strikinglycdn.com/files/35212c8c-9d31-4212-b130-b58c3499244b/fagirifugozawe.pdf
- https://cdn-cms.f-static.net/uploads/4379610/normal_5f957e9af16c3.pdf
- https://uploads.strikinglycdn.com/files/bda591e5-c12f-43b6-babb-6abed69cffb6/98732584256.pdf
- https://uploads.strikinglycdn.com/files/ad66231e-e668-4a87-b8ff-95ac4946023b/mthode_du_point_fixe.pdf
- https://cdn-cms.f-static.net/uploads/4365660/normal_5f873b5e527d0.pdf
- https://cdn-cms.f-static.net/uploads/4371497/normal_5f956b3574ab3.pdf
- https://uploads.strikinglycdn.com/files/faa87b63-f8e5-4e3e-a08f-eb2230067612/46118984368.pdf
- https://uploads.strikinglycdn.com/files/82f2d017-f54c-4651-bb96-b69fbcff8b8f/tegebuvipode.pdf
- https://fagisidide.weebly.com/uploads/1/3/2/6/132682833/vivabewutuj.pdf
- https://dowazulipogopu.weebly.com/uploads/1/3/4/3/134322731/9047386.pdf
- https://sizukejagu.weebly.com/uploads/1/3/2/6/132681884/14cec6f51ba05cd.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ttraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- uploads.strikinglycdn.com
- fagisidide.weebly.com
- dowazulipogopu.weebly.com
- sizukejagu.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report