SUSPICIOUS — normal_5f8e3da5f157c.pdf
SUSPICIOUS — normal_5f8e3da5f157c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
822b1bfe7ba103203478126631a545cc84e67b4f7a075f3bdc5b628be4cfcb3a - SHA-1:
45b9df780159d68848a8efedb3449c9964fb6760 - MD5:
c36004abfdff59580885e84b4ecbdec4 - ssdeep:
1536:5GFgeYlN3QejvCJ6mdXyFRFfp7oUJk2wD:MFgeSNFjvS6mdXy7FVoZ - TLSH:
T115339DF710A7ED8C7A8EAB039DFA1059614ADA8D6033E750048C372CD5BC6FE6E10A51 - Submitted as: normal_5f8e3da5f157c.pdf
- File type: pdf · Size: 49390 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/e119e486-13f2-4c77-beb4-6e8899a55534/mufulaka.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/123?keyword=dash+and+hyphen+worksheets, https://cdn.shopify.com/s/files/1/0497/5581/6090/files/schiller_letters_on_the_aesthetic_education_of_man.pdf, https://cdn.shopify.com/s/files/1/0435/3071/5295/files/new_york_medicaid_income_guidelines_2020.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=dash+and+hyphen+worksheets
- https://cdn.shopify.com/s/files/1/0497/5581/6090/files/schiller_letters_on_the_aesthetic_education_of_man.pdf
- https://cdn.shopify.com/s/files/1/0435/3071/5295/files/new_york_medicaid_income_guidelines_2020.pdf
- https://cdn.shopify.com/s/files/1/0501/9713/5541/files/difufapunusewuju.pdf
- https://uploads.strikinglycdn.com/files/e119e486-13f2-4c77-beb4-6e8899a55534/mufulaka.pdf
- https://cdn.shopify.com/s/files/1/0488/0672/3749/files/39542840305.pdf
- https://cdn.shopify.com/s/files/1/0484/1029/6480/files/91849830107.pdf
- https://cdn.shopify.com/s/files/1/0483/0599/5940/files/if_you_are_caught_in_a_severe_storm_in_your_boat_what_should_you_do.pdf
- https://cdn.shopify.com/s/files/1/0266/9510/6759/files/xuzevisusepapajididamakuz.pdf
- https://uploads.strikinglycdn.com/files/e2a91707-64b1-4435-9f43-5692d155f143/11504039481.pdf
- https://uploads.strikinglycdn.com/files/adcd6859-a470-4c3c-b45c-b6538af5c64a/46901802993.pdf
- https://uploads.strikinglycdn.com/files/0e351dce-e5f3-4804-af4d-c994b24f4537/22647870677.pdf
- https://uploads.strikinglycdn.com/files/23814182-56cf-45b5-97f2-cad51442a1a3/81533156762.pdf
- https://uploads.strikinglycdn.com/files/0a2fe0f4-fd58-4134-9d1c-16699c20d3b7/vuworugomawugejiboxenodu.pdf
- https://cdn.shopify.com/s/files/1/0486/3157/8782/files/zokabutuxeti.pdf
- https://cdn.shopify.com/s/files/1/0479/7140/1891/files/auto_skills_center_hickam.pdf
- https://cdn.shopify.com/s/files/1/0501/8304/5293/files/vuvarul.pdf
- https://cdn.shopify.com/s/files/1/0431/2449/0397/files/13074250403.pdf
- https://cdn.shopify.com/s/files/1/0484/3680/5800/files/cloranfenicol_en_ingles.pdf
- https://senobatupubem.weebly.com/uploads/1/3/1/4/131437889/kumugenivamido.pdf
- https://zevigetadafuwun.weebly.com/uploads/1/3/0/9/130969942/e1f54.pdf
- https://rigonabex.weebly.com/uploads/1/3/1/4/131483185/50df2e7a0825.pdf
- https://vozunutav.weebly.com/uploads/1/3/0/9/130969695/727149.pdf
- https://tivakoxidedopa.weebly.com/uploads/1/3/0/7/130776298/tetakidivikev.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- senobatupubem.weebly.com
- zevigetadafuwun.weebly.com
- rigonabex.weebly.com
- vozunutav.weebly.com
- tivakoxidedopa.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report