SUSPICIOUS — normal_5f876f48d6af0.pdf
SUSPICIOUS — normal_5f876f48d6af0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 4 of 53 detection engines flagged it.
Identification
- SHA-256:
624377ad0501eef2b213262a623018306af4dcfe0747e8700714a98fd6ba220f - SHA-1:
47d9382f81837ab5c8efcebf5dc3b95b9b7d26ad - MD5:
8c970b45d15f7532f3c0136e8fd56a63 - ssdeep:
1536:2GFd0puXgsYtFP4d2X+1DrQkU07HgyZ5vxJpLJk:PFOpuXVYzXcQ907gyjJvC - TLSH:
T19535BEF3A057ED8D7A8B6B03AEAA016D6089C78D7132979054CD672CC4BC6FD7E40A44 - Submitted as: normal_5f876f48d6af0.pdf
- File type: pdf · Size: 63085 bytes
- Verdict: suspicious (44/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=3d+rpg+games+apk+download+offline, https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/mukobuf.pdf, https://jeponiruwapin.weebly.com/uploads/1/3/0/7/130776483/5175097.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=3d+rpg+games+apk+download+offline
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/mukobuf.pdf
- https://jeponiruwapin.weebly.com/uploads/1/3/0/7/130776483/5175097.pdf
- https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/9b53ec72f.pdf
- https://lagukekejase.weebly.com/uploads/1/3/0/8/130815031/6662357.pdf
- https://cdn-cms.f-static.net/uploads/4366311/normal_5f876c6f3f868.pdf
- https://cdn-cms.f-static.net/uploads/4367951/normal_5f87678db6fff.pdf
- https://cdn-cms.f-static.net/uploads/4367656/normal_5f876e08c6706.pdf
- https://cdn-cms.f-static.net/uploads/4366325/normal_5f8747d7aab4c.pdf
- https://cdn-cms.f-static.net/uploads/4367013/normal_5f876b595a6f1.pdf
- https://cdn.shopify.com/s/files/1/0440/3570/2949/files/67264071094.pdf
- https://cdn.shopify.com/s/files/1/0481/3206/3383/files/trane_z_wave_thermostat_tzemt400bb32maa_manual.pdf
- https://cdn.shopify.com/s/files/1/0485/7567/6581/files/german_alphabet_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0484/4263/8504/files/91016929669.pdf
- https://cdn-cms.f-static.net/uploads/4366004/normal_5f871fddca4cd.pdf
- https://cdn-cms.f-static.net/uploads/4365642/normal_5f872d1d66a04.pdf
- https://cdn-cms.f-static.net/uploads/4366374/normal_5f875f03244f2.pdf
- https://cdn-cms.f-static.net/uploads/4366000/normal_5f876cb57ef43.pdf
- https://uploads.strikinglycdn.com/files/90ed9fda-42e8-4a11-b607-4cb68b88b859/91002393873.pdf
- https://uploads.strikinglycdn.com/files/dce164fa-fcaa-49d1-9b58-edfaedfb85bb/37223788713.pdf
- https://cdn-cms.f-static.net/uploads/4367627/normal_5f876a808bb13.pdf
- https://cdn-cms.f-static.net/uploads/4365634/normal_5f8708647205c.pdf
- https://cdn-cms.f-static.net/uploads/4367624/normal_5f87697170ad4.pdf
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f876b10be47c.pdf
- https://cdn-cms.f-static.net/uploads/4366365/normal_5f8723fcadac2.pdf
Embedded domains
- ggtraff.ru
- zoxuzuxebexot.weebly.com
- jeponiruwapin.weebly.com
- mogilifus.weebly.com
- lagukekejase.weebly.com
- cdn-cms.f-static.net
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report