SUSPICIOUS — normal_5f8dc275c2f66.pdf
SUSPICIOUS — normal_5f8dc275c2f66.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
94eb85fb730c4e10e8c510ad61e7706908da95eec16d1f8a24b60db4d47238aa - SHA-1:
ddf89d898cf4a3f661c1a05c233007668f10601a - MD5:
e006dedc6a7addb0d2f91cd268e7b6c3 - ssdeep:
768:CgGzpD4pBPOGV2Hexi4QvPAyu0OTtV2OSkaCEPDNevpTWUM9ddjqWj+dlysy:fGFcpVyu0Mtgn+WNGRM/djqWj+dlysy - TLSH:
T10A339EF360E7DD8C7B8B9B176DA31559604AC7886137D3904888BB3CC4BC57E6E61A20 - Submitted as: normal_5f8dc275c2f66.pdf
- File type: pdf · Size: 50217 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.cc/123?keyword=download+dr+web+antivirus+pro+apk, https://cdn-cms.f-static.net/uploads/4371806/normal_5f8d2078cfb61.pdf, https://cdn-cms.f-static.net/uploads/4365539/normal_5f871abf556f3.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.cc/123?keyword=download+dr+web+antivirus+pro+apk
- https://cdn-cms.f-static.net/uploads/4371806/normal_5f8d2078cfb61.pdf
- https://cdn-cms.f-static.net/uploads/4365539/normal_5f871abf556f3.pdf
- https://cdn-cms.f-static.net/uploads/4365602/normal_5f86f95f49606.pdf
- https://cdn-cms.f-static.net/uploads/4379385/normal_5f8d877cced77.pdf
- https://uploads.strikinglycdn.com/files/5c100100-bd8c-4f26-8fe5-39dfed699670/2_foil_characters_in_romeo_and_juliet.pdf
- https://cdn-cms.f-static.net/uploads/4379483/normal_5f8a873f3b36d.pdf
- https://cdn-cms.f-static.net/uploads/4366406/normal_5f8a852845761.pdf
- https://cdn-cms.f-static.net/uploads/4366652/normal_5f89d05843b93.pdf
- https://uploads.strikinglycdn.com/files/8282b3db-a04b-4940-9916-2d49987b24a3/senevasikuremoro.pdf
- https://uploads.strikinglycdn.com/files/0d8bbbf5-5792-4247-ad9c-594a945fa179/zedexusefule.pdf
- https://uploads.strikinglycdn.com/files/1bd67d3a-a606-4b45-9de9-7fed095283cf/85480695992.pdf
- https://uploads.strikinglycdn.com/files/5479e28a-0c4a-494e-9755-db5ef4a397b7/97080331361.pdf
- https://uploads.strikinglycdn.com/files/daad54d8-224c-4e46-90df-300d0e33dc11/71291023207.pdf
- https://wozofawado.weebly.com/uploads/1/3/0/8/130874325/99727b637.pdf
- https://wekubuzebebam.weebly.com/uploads/1/3/0/7/130739705/3afc7b8.pdf
- https://xijonezamo.weebly.com/uploads/1/3/1/4/131407630/navowifepefewafo.pdf
- https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/127963.pdf
- https://tanifovekula.weebly.com/uploads/1/3/1/3/131379991/lemomuwerife_xoberoko.pdf
- https://cdn.shopify.com/s/files/1/0266/9523/7813/files/carta_de_esculapio_a_su_hijo.pdf
- https://cdn.shopify.com/s/files/1/0488/4080/2469/files/tommee_tippee_variflow_teats_instructions.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ttraff.cc
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- wozofawado.weebly.com
- wekubuzebebam.weebly.com
- xijonezamo.weebly.com
- jakedekokobara.weebly.com
- tanifovekula.weebly.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report