SUSPICIOUS — normal_5fa60dac98116.pdf

SUSPICIOUS — normal_5fa60dac98116.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 8a2e91c2fd154ad5e1e5b39c0e2275f5aa343fd30e92d266ace4ce4334b1d361
• SHA-1: 40eec5a9ea8190a33a5b468e5da8ac5e37554bb6
• MD5: f423f1f5e790e91673bba10e447b14a2
• ssdeep: 768:DgGzpDTNeMdmCmEEM2ptJcJ9UySqrjjlobynwA1Hr72h33eL:8GFVtmV9pkJSqrXe3AZPC+L
• TLSH: T1C4319EF350A7DD8C7687AF03AEBA1455218AC78CA03387B4549C773DC4BC6AD6E44861
• Submitted as: normal_5fa60dac98116.pdf
• File type: pdf · Size: 42008 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://traffset.ru/123?keyword=tuxedo+sam+shirt, https://lipebelotoj.weebly.com/uploads/1/3/4/4/134475440/41d7b50.pdf, https://xaruxetadelu.weebly.com/uploads/1/3/4/4/134478950/gozogefunanu_dokufedog_posadalu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://traffset.ru/123?keyword=tuxedo+sam+shirt
• https://gedojizus.files.wordpress.com/2020/11/52399303326.pdf
• https://lipebelotoj.weebly.com/uploads/1/3/4/4/134475440/41d7b50.pdf
• https://xaruxetadelu.weebly.com/uploads/1/3/4/4/134478950/gozogefunanu_dokufedog_posadalu.pdf
• https://kirewigofe.weebly.com/uploads/1/3/4/3/134382955/8798174.pdf
• https://xojisige.weebly.com/uploads/1/3/1/6/131637148/cd019fb0.pdf
• https://fiwerabonu.weebly.com/uploads/1/3/4/3/134347662/9485177.pdf
• https://jixobufasov.weebly.com/uploads/1/3/4/3/134324480/sigif_wesebaxelul_kegubikemoj_lajegozodo.pdf
• https://cdn-cms.f-static.net/uploads/4411001/normal_5f9ced7a80589.pdf
• https://fobedixosofano.weebly.com/uploads/1/3/4/3/134377241/xuxijexixalizas.pdf
• https://jixatazibasuv.weebly.com/uploads/1/3/4/4/134402985/pedezetozoxovufebo.pdf
• https://s3.amazonaws.com/tamobalasu/meaning_of_illiteracy.pdf
• https://s3.amazonaws.com/fajonubinomeder/2419284910.pdf
• https://losazutuliwuja.weebly.com/uploads/1/3/4/6/134622760/fitujazidokuvagufi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffset.ru
• gedojizus.files.wordpress.com
• lipebelotoj.weebly.com
• xaruxetadelu.weebly.com
• kirewigofe.weebly.com
• xojisige.weebly.com
• fiwerabonu.weebly.com
• jixobufasov.weebly.com
• cdn-cms.f-static.net
• fobedixosofano.weebly.com
• jixatazibasuv.weebly.com
• s3.amazonaws.com
• losazutuliwuja.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report