SUSPICIOUS — normal_5f89e12bade3a.pdf
SUSPICIOUS — normal_5f89e12bade3a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
83a83e880b3095d7e96b2dbffa8d07e7b4c6a2253b8e4ca533098ef6efbc1969 - SHA-1:
5f5f57cf35a5d3c02ea888919efd8ff18822f238 - MD5:
a50703d05e89f44a3f4ae4bbca8dbc14 - ssdeep:
1536:jGFdpmFRmHY6qqbWAcZA74jf98NTbMb+dmxSoAIHpF2PuAEJs:yFdpmFRmHqph24jfSNTwbmqSohK - TLSH:
T10237C0F31567EC8D2E476B53AFF7216A6089D7CC2136A3A04848A72CC5BC57E7E20521 - Submitted as: normal_5f89e12bade3a.pdf
- File type: pdf · Size: 73712 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://wekubuzebebam.weebly.com/uploads/1/3/0/7/130739705/c6c9fe7ad41f6e.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ttraff.ru/123?keyword=object+oriented+programming+balaguruswamy+pdf+free+download, https://cdn.shopify.com/s/files/1/0485/0912/4763/files/riverside_high_school_ohio.pdf, https://cdn.shopify.com/s/files/1/0428/1260/4582/files/97148569189.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.ru/123?keyword=object+oriented+programming+balaguruswamy+pdf+free+download
- https://cdn.shopify.com/s/files/1/0485/0912/4763/files/riverside_high_school_ohio.pdf
- https://cdn.shopify.com/s/files/1/0428/1260/4582/files/97148569189.pdf
- https://cdn.shopify.com/s/files/1/0434/5161/3336/files/my_time_at_portia_update_steam.pdf
- https://cdn.shopify.com/s/files/1/0427/9736/7452/files/a_week_in_the_woods_full_book.pdf
- https://cdn.shopify.com/s/files/1/0435/0646/6975/files/dan_wesson_revolver_interchangeable_barrels_for_sale.pdf
- https://cdn.shopify.com/s/files/1/0429/9200/9379/files/36415662630.pdf
- https://cdn.shopify.com/s/files/1/0503/3544/9238/files/uglys_electrical_reference_2015_download.pdf
- https://wekubuzebebam.weebly.com/uploads/1/3/0/7/130739705/c6c9fe7ad41f6e.pdf
- https://kusanogiwaxug.weebly.com/uploads/1/3/0/8/130873987/6089907cad1d787.pdf
- https://uploads.strikinglycdn.com/files/3851e06a-562c-4190-8db7-9e4f3485fc3c/40452588771.pdf
- https://uploads.strikinglycdn.com/files/a5558f8f-5f6e-402e-b6f2-6b92e2ea36fc/56816207341.pdf
- https://uploads.strikinglycdn.com/files/e9f2f8cf-5e26-49c3-ac6c-090a6369ec67/75270722834.pdf
- https://uploads.strikinglycdn.com/files/7ac62726-7465-4269-995b-10a62fa4f1fb/25900001022.pdf
- https://uploads.strikinglycdn.com/files/19b0f843-8796-4a68-b8e1-6da1c9cea88d/tagubojilowitofulajuxo.pdf
- https://cdn.shopify.com/s/files/1/0438/3624/4118/files/similar_shapes_worksheet_answers.pdf
- https://cdn.shopify.com/s/files/1/0478/3842/9343/files/kozupizogutu.pdf
- https://cdn-cms.f-static.net/uploads/4365655/normal_5f8741f3cc438.pdf
- https://cdn-cms.f-static.net/uploads/4368218/normal_5f89d2df5456e.pdf
- https://cdn-cms.f-static.net/uploads/4365638/normal_5f88457cf2f60.pdf
- https://cdn-cms.f-static.net/uploads/4369663/normal_5f87f8c48aaed.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ttraff.ru
- cdn.shopify.com
- wekubuzebebam.weebly.com
- kusanogiwaxug.weebly.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report