SUSPICIOUS — normal_5f8d71c2025c6.pdf
SUSPICIOUS — normal_5f8d71c2025c6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
66a3db5a0e978476f064e350783ad9b7200f226cc7ca73ff1413fae9349665bf - SHA-1:
242e779e164cb75ab9c26992f6e09de3b47d131a - MD5:
a5c37d4add56f074f5bd7d4c33b2659c - ssdeep:
1536:nGF1pbKD55CE1/ieSf9cHdFHEFbdH6hl:GF1pWDurd1MHE1te - TLSH:
T179339DF350A7EC8D7B8A9B039DEB16596149D68C5032CAA0858C7B2CD53CABE2F10751 - Submitted as: normal_5f8d71c2025c6.pdf
- File type: pdf · Size: 49657 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/123?keyword=download+deer+hunter+classic+mod+apk+revdl, https://cdn.shopify.com/s/files/1/0481/6348/7897/files/68987365689.pdf, https://cdn.shopify.com/s/files/1/0496/7255/2601/files/fekekumitiwur.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=download+deer+hunter+classic+mod+apk+revdl
- https://cdn.shopify.com/s/files/1/0481/6348/7897/files/68987365689.pdf
- https://cdn.shopify.com/s/files/1/0496/7255/2601/files/fekekumitiwur.pdf
- https://cdn.shopify.com/s/files/1/0480/5269/9300/files/can_and_could_exercises_for_elementary.pdf
- https://cdn.shopify.com/s/files/1/0432/0319/9138/files/17636878571.pdf
- https://cdn.shopify.com/s/files/1/0440/8606/7352/files/troy_bilt_super_bronco_lawn_tractor_repair_manual.pdf
- https://cdn-cms.f-static.net/uploads/4374518/normal_5f8d087527c1d.pdf
- https://cdn-cms.f-static.net/uploads/4374380/normal_5f895621448ba.pdf
- https://cdn-cms.f-static.net/uploads/4368976/normal_5f88ccad2b07a.pdf
- https://cdn.shopify.com/s/files/1/0266/9222/3151/files/tao_law_professional_corporation.pdf
- https://cdn.shopify.com/s/files/1/0430/8706/9335/files/craftsman_router_table_combo_26501.pdf
- https://cdn.shopify.com/s/files/1/0434/4764/8406/files/gedukexidugijafeziwijorow.pdf
- https://cdn.shopify.com/s/files/1/0504/2064/6048/files/hipaa_guidelines_for_social_media.pdf
- https://cdn.shopify.com/s/files/1/0502/1673/0799/files/vumimideg.pdf
- https://cdn.shopify.com/s/files/1/0496/3001/9780/files/horse_poems_short.pdf
- https://cdn.shopify.com/s/files/1/0483/2480/4761/files/final_answer_bull.pdf
- https://uploads.strikinglycdn.com/files/ac0186f8-ebd9-483c-9274-8e77ab94e075/logageburojodureteke.pdf
- https://uploads.strikinglycdn.com/files/be28291e-30dc-46f4-8122-9ad33f22f6ad/bezitemaxid.pdf
- https://uploads.strikinglycdn.com/files/6f157bfd-8329-4f4c-942a-bb8071331db7/husqvarna_chainsaw_455_rancher_service_manual.pdf
- https://uploads.strikinglycdn.com/files/d758fc4b-b645-43d3-bdff-865d27a629f1/51284911669.pdf
- https://uploads.strikinglycdn.com/files/3d826c09-f484-4e62-88a4-cecf81f2d4c2/17177006549.pdf
- https://cdn-cms.f-static.net/uploads/4366337/normal_5f875117d9112.pdf
- https://cdn-cms.f-static.net/uploads/4380411/normal_5f8d0573c0389.pdf
- https://cdn-cms.f-static.net/uploads/4377410/normal_5f8c5fbe8331e.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report