SUSPICIOUS — normal_5f875bc0a6bb2.pdf
SUSPICIOUS — normal_5f875bc0a6bb2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
788b1c2c8d82bfec2d49e1b52d4be56c53e7694c6a58e6c62a1f6d73fe351da8 - SHA-1:
fa45286c1aa54a83262ab13207c6ebb6207f5766 - MD5:
a457ce11653c09c7a05c97a2fb7f7bb7 - ssdeep:
1536:mGFhpmc0V97m5mt4K0uXQihX5fmqaUZhN9c:/Fhpmc077m5mMyzhpfmqayh8 - TLSH:
T19F34BFF35467EC4D7A8B6B03ADE3019C508AC38C5233A7604998776DE47C9BD7E00960 - Submitted as: normal_5f875bc0a6bb2.pdf
- File type: pdf · Size: 54751 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=jasper+report+pdf+default+font, https://uploads.strikinglycdn.com/files/ed2061eb-f284-4d2d-ac30-d0a1a7a6477d/somerirabigif.pdf, https://uploads.strikinglycdn.com/files/6d239ca5-80be-4c10-8767-d821b7c0115d/lagog.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/123?keyword=jasper+report+pdf+default+font
- https://uploads.strikinglycdn.com/files/ed2061eb-f284-4d2d-ac30-d0a1a7a6477d/somerirabigif.pdf
- https://uploads.strikinglycdn.com/files/6d239ca5-80be-4c10-8767-d821b7c0115d/lagog.pdf
- https://uploads.strikinglycdn.com/files/abf80b70-a3b1-4a55-9214-e68b185006dc/netavubo.pdf
- https://uploads.strikinglycdn.com/files/4d943964-c90f-406c-88f9-c1243fa90d36/rupot.pdf
- https://uploads.strikinglycdn.com/files/a5c68a40-d603-4183-b933-9396f2ca8407/78428779536.pdf
- https://cdn-cms.f-static.net/uploads/4365567/normal_5f86f52df1ea3.pdf
- https://cdn-cms.f-static.net/uploads/4365653/normal_5f874b0d05c80.pdf
- https://cdn.shopify.com/s/files/1/0432/1270/1854/files/kidaxutumade.pdf
- https://cdn.shopify.com/s/files/1/0430/6904/6935/files/bufesarisovur.pdf
- https://cdn.shopify.com/s/files/1/0434/0901/4940/files/marco_polo_map_activity.pdf
- https://cdn.shopify.com/s/files/1/0434/3254/2369/files/members_only_vol_4_wallpaper.pdf
- https://cdn.shopify.com/s/files/1/0500/9093/4437/files/fruits_basket_curse_characters.pdf
- https://site-1042824.mozfiles.com/files/1042824/89073732900.pdf
- https://site-1043809.mozfiles.com/files/1043809/17964856531.pdf
- https://site-1039992.mozfiles.com/files/1039992/goxemoxopagafuboruwir.pdf
- https://site-1038703.mozfiles.com/files/1038703/nixaxe.pdf
- https://uploads.strikinglycdn.com/files/56b94c2b-0e42-456f-98f3-312e5a91428f/fimikudedopuzuxebudajop.pdf
- https://uploads.strikinglycdn.com/files/5e730660-0d07-48b5-b52c-770bc337c274/88474608593.pdf
- https://uploads.strikinglycdn.com/files/e60157bb-5c5c-4045-abca-d9db0b985f40/15397797807.pdf
- https://uploads.strikinglycdn.com/files/a2191ffc-af2b-46b7-a9df-50a1e6e5280e/juwirazexoxufiviwesaju.pdf
- https://site-1044020.mozfiles.com/files/1044020/80081284377.pdf
- https://site-1036858.mozfiles.com/files/1036858/zubeturefemodaxibobinakox.pdf
- https://site-1040034.mozfiles.com/files/1040034/56906961026.pdf
- https://site-1040124.mozfiles.com/files/1040124/12512108461.pdf
Embedded domains
- gettraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- cdn.shopify.com
- site-1042824.mozfiles.com
- site-1043809.mozfiles.com
- site-1039992.mozfiles.com
- site-1038703.mozfiles.com
- site-1044020.mozfiles.com
- site-1036858.mozfiles.com
- site-1040034.mozfiles.com
- site-1040124.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report