MALICIOUS — normal_5f87b12180b56.pdf
MALICIOUS — normal_5f87b12180b56.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
8cf930e0cfad68ffc12da529b84f7e85273889439a829a2c5d218c7f4ddcf4c7 - SHA-1:
8f23ea96adb689305693e4dcacd51a1a66036ac0 - MD5:
c9328dd29fc41f94c2769ca51431e066 - ssdeep:
768:IggGzpDwp9klRovQ7attO3Jw1hKccmDIz8bJBcA1YSouF0LQM:gGF8pgRxz2cA1Y9uF0LQM - TLSH:
T18E327BF360ABEC4C3A86DF13AEEF155D918AD7489132A6A409DC761CC47C2AD7F10960 - Submitted as: normal_5f87b12180b56.pdf
- File type: pdf · Size: 44675 bytes
- Verdict: malicious (75/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://cdn-cms.f-static.net/uploads/4366377/normal_5f873b45f22d3.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=barcode+scanner+app+for+inventory+android, https://cdn-cms.f-static.net/uploads/4366377/normal_5f873b45f22d3.pdf, https://cdn-cms.f-static.net/uploads/4366028/normal_5f876113620b4.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://ggtraff.ru/123?keyword=barcode+scanner+app+for+inventory+android
- https://cdn-cms.f-static.net/uploads/4366377/normal_5f873b45f22d3.pdf
- https://cdn-cms.f-static.net/uploads/4366028/normal_5f876113620b4.pdf
- https://cdn-cms.f-static.net/uploads/4366316/normal_5f8771cc7d3a0.pdf
- https://cdn-cms.f-static.net/uploads/4366646/normal_5f8786d4d5e99.pdf
- https://cdn-cms.f-static.net/uploads/4367301/normal_5f8768a6bc0b5.pdf
- https://uploads.strikinglycdn.com/files/ce6fc45b-6f68-49e4-b679-5a765a61d5e3/61775340062.pdf
- https://uploads.strikinglycdn.com/files/8eace47a-d415-4268-84be-9a24ad8b9707/fevetiseni.pdf
- https://uploads.strikinglycdn.com/files/027159b9-5084-45e4-a4bc-47e09b401fcf/lepix.pdf
- https://uploads.strikinglycdn.com/files/24b7f152-9cac-4916-b1f8-9fb73b4aeaa6/miradowezerusozopamuref.pdf
- https://cdn.shopify.com/s/files/1/0476/9828/0604/files/modeling_chemistry_unit_3_review_answers.pdf
- https://cdn.shopify.com/s/files/1/0497/4922/9722/files/hurricane_spin_mop_warranty.pdf
- https://cdn.shopify.com/s/files/1/0465/0860/5590/files/5808427857.pdf
- https://cdn.shopify.com/s/files/1/0483/7326/8633/files/rawusalopuvulemomexul.pdf
- https://cdn.shopify.com/s/files/1/0492/0587/0758/files/action_and_linking_verbs_worksheet_answer_key.pdf
- https://mojenosude.weebly.com/uploads/1/3/1/3/131382274/xowugefodizez.pdf
- https://boguvetasitob.weebly.com/uploads/1/3/1/3/131380850/fe19c4.pdf
- https://uploads.strikinglycdn.com/files/11febdf5-a980-40f9-b263-8f1559a3c622/tofebujomoju.pdf
- https://uploads.strikinglycdn.com/files/56f6e5ed-2f98-4d4e-b1dc-d11071746307/galeluzasokamedijolisu.pdf
- https://uploads.strikinglycdn.com/files/04033dfc-a2e6-4032-96da-523feb8aee35/bodelopiril.pdf
- https://uploads.strikinglycdn.com/files/07d30b85-86b4-466b-aab9-0c1ba16a9fe7/tuvuxirenozexu.pdf
- https://cdn-cms.f-static.net/uploads/4366043/normal_5f87662079a31.pdf
- https://cdn-cms.f-static.net/uploads/4368971/normal_5f87a3cb7609a.pdf
- https://cdn-cms.f-static.net/uploads/4367004/normal_5f874c9478b36.pdf
- https://cdn-cms.f-static.net/uploads/4367289/normal_5f873e86c750a.pdf
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- mojenosude.weebly.com
- boguvetasitob.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
File paths
- u:\jU
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report