MALICIOUS — normal_5f8760ac1fb59.pdf

MALICIOUS — normal_5f8760ac1fb59.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 52 detection engines flagged it.

Identification

SHA-256: 67b2e6a100e12249b77814f256e82bd6f3538f504a0f22d5b885f4a9576a39e5
SHA-1: 76208b79c882ede6d5c11c36b16e3ad325d56eec
MD5: 280b12cb68b9754fe08caf16f1862e0d
ssdeep: 1536:oGF4pMwbv7mpt0PG/+EMQetAL4ZcGlLWw4sM78Y:FF4pMwbHnyGlLiFX
TLSH: T19E35CFF7459BED8CB6CB9B436DA6149D6189C78C2123A3A055CC7B2CD5BC3BD6E10820
Submitted as: normal_5f8760ac1fb59.pdf
File type: pdf · Size: 60163 bytes
Verdict: malicious (88/100)

Detections (3 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ggtraff.ru/123?keyword=contoh+pkm+penelitian+pertanian+pdf, https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/9232432.pdf, https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/ff06dfdf.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ggtraff.ru/123?keyword=contoh+pkm+penelitian+pertanian+pdf
https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/9232432.pdf
https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/ff06dfdf.pdf
https://zoveponezewuda.weebly.com/uploads/1/3/0/7/130738822/7706681.pdf
https://cdn.shopify.com/s/files/1/0268/8273/6309/files/shih_tzu_puppies.pdf
https://cdn.shopify.com/s/files/1/0438/4066/7808/files/pedilevegozonipulu.pdf
https://cdn.shopify.com/s/files/1/0480/7242/5636/files/45763469342.pdf
https://cdn.shopify.com/s/files/1/0481/3989/4947/files/diet_cel_ray_soda.pdf
https://cdn-cms.f-static.net/uploads/4365635/normal_5f87433f06e4c.pdf
https://cdn-cms.f-static.net/uploads/4366036/normal_5f8757180cfa4.pdf
https://nudojafobedem.weebly.com/uploads/1/3/1/3/131379550/bigagenud.pdf
https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/4333548.pdf
https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/d96ddb407408.pdf
https://uploads.strikinglycdn.com/files/7f1ea72d-e273-4e1f-a28f-a69b0e273ebf/fovujagir.pdf
https://uploads.strikinglycdn.com/files/c07aa659-e6d2-4a39-b58f-0d20b9217aa4/nigefoxaxaf.pdf
https://site-1039644.mozfiles.com/files/1039644/fupifepuvij.pdf
https://site-1036629.mozfiles.com/files/1036629/11424961617.pdf
https://site-1043796.mozfiles.com/files/1043796/goradobavu.pdf
https://site-1043559.mozfiles.com/files/1043559/guitarraviva_losing_my_religion.pdf
https://site-1040329.mozfiles.com/files/1040329/86044482842.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

ggtraff.ru
jawasolasazilem.weebly.com
genigudepa.weebly.com
zoveponezewuda.weebly.com
cdn.shopify.com
cdn-cms.f-static.net
nudojafobedem.weebly.com
wepugimi.weebly.com
gimejexoxixaza.weebly.com
uploads.strikinglycdn.com
site-1039644.mozfiles.com
site-1036629.mozfiles.com
site-1043796.mozfiles.com
site-1043559.mozfiles.com
site-1040329.mozfiles.com
w.au
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report