SUSPICIOUS — normal_5f8880cef40d2.pdf
SUSPICIOUS — normal_5f8880cef40d2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
7f8ec9fb6af6cc5074e61df9cbcf9b0cd362216534832f31ea4ca58a2cd1aff6 - SHA-1:
b8d33cfbd31baa1054ee7cad53985861dc348fdd - MD5:
f16614a31e6b586b5541375a98c76d81 - ssdeep:
768:sgGzpDApj/capquL7qxaGm2sMSRpNDcUCCLWAkqEINFDGujBfT9o:pGFEpguPqxaGrrQYqlySfT9o - TLSH:
T107327DF310A7DD4C7E8AAB03AEBB115D654ADB89613797A0048C232CD4BC6FD6F04A51 - Submitted as: normal_5f8880cef40d2.pdf
- File type: pdf · Size: 45376 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=football+word+search+printable+pdf, https://cdn.shopify.com/s/files/1/0486/1178/6912/files/washtenaw_community_college_calendar_2016-17.pdf, https://cdn.shopify.com/s/files/1/0431/0987/5873/files/sevex.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=football+word+search+printable+pdf
- https://cdn.shopify.com/s/files/1/0486/1178/6912/files/washtenaw_community_college_calendar_2016-17.pdf
- https://cdn.shopify.com/s/files/1/0431/0987/5873/files/sevex.pdf
- https://cdn.shopify.com/s/files/1/0435/3789/1480/files/mahindra_3525_oil_filter_cross_reference.pdf
- https://cdn.shopify.com/s/files/1/0496/7196/2777/files/musavagidebil.pdf
- https://uploads.strikinglycdn.com/files/de7f068d-8df7-4eac-8898-824f3c403607/22584380958.pdf
- https://uploads.strikinglycdn.com/files/09057c39-b64b-4a22-96de-e5ee0038da9c/sukefosedoz.pdf
- https://uploads.strikinglycdn.com/files/aceca455-ee32-4d88-8388-f3686ac01c95/25183907467.pdf
- https://uploads.strikinglycdn.com/files/a7a2472d-dd15-4a52-825a-dce1177d6503/76999920503.pdf
- https://cdn-cms.f-static.net/uploads/4367311/normal_5f87c07a6a873.pdf
- https://cdn-cms.f-static.net/uploads/4367632/normal_5f87c694c0c1e.pdf
- https://cdn-cms.f-static.net/uploads/4366014/normal_5f87b080b142d.pdf
- https://cdn.shopify.com/s/files/1/0435/7616/4515/files/fifadoxifu.pdf
- https://cdn.shopify.com/s/files/1/0486/7450/4854/files/normal_uterine_thickness_on_ultrasound.pdf
- https://cdn.shopify.com/s/files/1/0482/8535/2100/files/descargar_teologia_sistematica_wayne_grudem_gratis.pdf
- https://cdn.shopify.com/s/files/1/0501/8330/7425/files/guide_paladin_smite_anti-uber.pdf
- https://cdn.shopify.com/s/files/1/0433/9433/4870/files/spherical_harmonic_function_fortran.pdf
- https://uploads.strikinglycdn.com/files/608cec67-da74-4c68-8adb-ffb3f2fee885/10361985463.pdf
- https://uploads.strikinglycdn.com/files/bc73c669-dd97-4504-80fb-282b92bf3d53/64861720244.pdf
- https://uploads.strikinglycdn.com/files/430a6d19-84a3-4626-939f-fe15f3a5d086/tumonexizufe.pdf
- https://uploads.strikinglycdn.com/files/745f7b17-a622-4c2f-9423-a7547cdd0943/85278594099.pdf
- https://uploads.strikinglycdn.com/files/f30df8b5-dc2f-47da-a002-80dd4af261d9/balogeguvokuseren.pdf
- https://uploads.strikinglycdn.com/files/de60f628-c17d-46f1-b3ed-eb6ce5dd92a8/64795352599.pdf
- https://uploads.strikinglycdn.com/files/943d5ec3-4b74-4105-a38c-262d45ea3b1a/18698629950.pdf
- https://uploads.strikinglycdn.com/files/5a236741-3159-4fd8-a149-3c84fe51b986/numuvazalununiwoli.pdf
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report