SUSPICIOUS — normal_5f87ec3230074.pdf
SUSPICIOUS — normal_5f87ec3230074.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
93ab8ec8f4421bf37ed152a1a70fc81bf974b4bb7c381944fa0875ae2d07e1f3 - SHA-1:
605de5cc49e136c0f3a167be6b66234a447ea606 - MD5:
f3680141be2c5f45867b0a1db01a0dcc - ssdeep:
768:TgGzpDae3trDjqkhtb13HiFlqHl8rIJSDCxaCEbqWs7l7E17McYtbmm:sGFOeBOiCImi1yqWs78QcYtbmm - TLSH:
T17A337DF35093CD8C7AC79B536DAB216CA089CB486173AAA058947B6CC47C3BD7F10521 - Submitted as: normal_5f87ec3230074.pdf
- File type: pdf · Size: 48690 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=paralisis+del+nervio+trigemino+pdf, https://cdn.shopify.com/s/files/1/0432/9383/5432/files/vanid.pdf, https://cdn.shopify.com/s/files/1/0481/7374/4277/files/belarusijekuxovibibikavev.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/123?keyword=paralisis+del+nervio+trigemino+pdf
- https://cdn.shopify.com/s/files/1/0432/9383/5432/files/vanid.pdf
- https://cdn.shopify.com/s/files/1/0481/7374/4277/files/belarusijekuxovibibikavev.pdf
- https://cdn.shopify.com/s/files/1/0428/5458/0391/files/tuleliguxudeniji.pdf
- https://cdn.shopify.com/s/files/1/0431/6600/7445/files/50743429210.pdf
- https://site-1038857.mozfiles.com/files/1038857/pusuzabi.pdf
- https://site-1039301.mozfiles.com/files/1039301/7840512393.pdf
- https://site-1036861.mozfiles.com/files/1036861/narur.pdf
- https://cdn-cms.f-static.net/uploads/4368788/normal_5f87d7c514728.pdf
- https://cdn-cms.f-static.net/uploads/4369182/normal_5f87a15bcf9b4.pdf
- https://cdn-cms.f-static.net/uploads/4367279/normal_5f87389b28a48.pdf
- https://cdn-cms.f-static.net/uploads/4366623/normal_5f87cf28e51cf.pdf
- https://cdn-cms.f-static.net/uploads/4368478/normal_5f87e472a1911.pdf
- https://uploads.strikinglycdn.com/files/4efd709c-b97c-4a35-9777-2c7ac9b49d31/95097467066.pdf
- https://uploads.strikinglycdn.com/files/6684d9a5-141c-465a-b6fd-f46e62603fe4/50263881300.pdf
- https://site-1039535.mozfiles.com/files/1039535/zukevudafi.pdf
- https://site-1041090.mozfiles.com/files/1041090/6419650241.pdf
- https://site-1048522.mozfiles.com/files/1048522/84131709600.pdf
- https://site-1036759.mozfiles.com/files/1036759/52227999761.pdf
- https://site-1039171.mozfiles.com/files/1039171/diferobixalowe.pdf
- https://site-1038429.mozfiles.com/files/1038429/pavigazufewegufoberusata.pdf
- https://site-1039400.mozfiles.com/files/1039400/33774176120.pdf
- https://site-1042729.mozfiles.com/files/1042729/11350026276.pdf
- https://site-1044009.mozfiles.com/files/1044009/89840549571.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- gettraff.ru
- cdn.shopify.com
- site-1038857.mozfiles.com
- site-1039301.mozfiles.com
- site-1036861.mozfiles.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- site-1039535.mozfiles.com
- site-1041090.mozfiles.com
- site-1048522.mozfiles.com
- site-1036759.mozfiles.com
- site-1039171.mozfiles.com
- site-1038429.mozfiles.com
- site-1039400.mozfiles.com
- site-1042729.mozfiles.com
- site-1044009.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report