SUSPICIOUS — normal_5f9bbd394f978.pdf

SUSPICIOUS — normal_5f9bbd394f978.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 5a90a370da34dc6d9f7ba1fef65176782caea7212f13aa7016377822ebd75f2e
• SHA-1: 8680f37b702d2974a605f54d279922c1279850e6
• MD5: 44b21e4d981b0fe8bba19608b16b9fa1
• ssdeep: 768:ugGzpDLTvDwveFUCDWqL4TenTNj97gcrB:LGFvz1M6nTP8crB
• TLSH: T13C2E8DF340A7EC8D7ACBE713AEA61116145AC74CA023A6B058CC777CC4BC6BD6E50961
• Submitted as: normal_5f9bbd394f978.pdf
• File type: pdf · Size: 31832 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/123?keyword=active+transport+biology+bbc+bitesize, https://sepikupi.weebly.com/uploads/1/3/0/7/130738949/pibipokave_boluwiwevov_kolar.pdf, https://cdn.shopify.com/s/files/1/0431/4575/6821/files/galer.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/123?keyword=active+transport+biology+bbc+bitesize
• https://s3.amazonaws.com/lovetijif/39255320334.pdf
• https://sepikupi.weebly.com/uploads/1/3/0/7/130738949/pibipokave_boluwiwevov_kolar.pdf
• https://cdn.shopify.com/s/files/1/0431/4575/6821/files/galer.pdf
• https://cdn.shopify.com/s/files/1/0505/8740/2405/files/vivaditavurofeluwiwopuw.pdf
• https://s3.amazonaws.com/loxopudizus/barron_clothing_catalogue.pdf
• https://cdn.shopify.com/s/files/1/0507/6644/6783/files/likizikakesizuwojuje.pdf
• https://s3.amazonaws.com/napoledunadigo/best_markup_and_annotation_apps_for_ipad.pdf
• https://lusukukupesakub.weebly.com/uploads/1/3/0/8/130815137/8605897.pdf
• https://cdn.shopify.com/s/files/1/0483/2493/5833/files/daily_english_words_in_marathi.pdf
• https://s3.amazonaws.com/pazifetanegapu/vipoworido.pdf
• https://s3.amazonaws.com/tobobowu/tomakawunemepad.pdf
• https://cdn.shopify.com/s/files/1/0462/1592/1818/files/prescott_elementary_school_cookeville_tn.pdf
• https://s3.amazonaws.com/megulu/vuzez.pdf
• https://cdn.shopify.com/s/files/1/0500/3329/5546/files/briggs_and_stratton_vanguard_parts_manual.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• s3.amazonaws.com
• sepikupi.weebly.com
• cdn.shopify.com
• lusukukupesakub.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report