SUSPICIOUS — normal_5f924021374e8.pdf
SUSPICIOUS — normal_5f924021374e8.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
94f70fcd18b7f754af3de42f8651626f3ac879392e7b31253d3c679df68da9c3 - SHA-1:
2c40637697df0aa9a89287cb712a52f63b62433c - MD5:
77a5fcfc0bf8737e7005d2093d6fcdbb - ssdeep:
768:CgGzpD3pEwtrPCdMUaNi2ChTk4Yms/mKzuQ+9oUc2B/W5pgRukKkfMIOiyfRL:fGFzpEAKMDNifGmsT5WRuk5fMviyfRL - TLSH:
T19D34AFF72063ED4DB986EF13BEBA2118918DD64D5132979085887B2CC0BC6BE7F50920 - Submitted as: normal_5f924021374e8.pdf
- File type: pdf · Size: 52444 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=condyloma+acuminata+journal+pdf, https://uploads.strikinglycdn.com/files/cdfd27f4-af43-4f82-9ff4-d22a06c6d31d/56931975458.pdf, https://uploads.strikinglycdn.com/files/4d7f50b1-bbc6-4891-8062-c1d33d2f69d0/nipusuwixififevoxipuvarev.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=condyloma+acuminata+journal+pdf
- https://uploads.strikinglycdn.com/files/cdfd27f4-af43-4f82-9ff4-d22a06c6d31d/56931975458.pdf
- https://uploads.strikinglycdn.com/files/4d7f50b1-bbc6-4891-8062-c1d33d2f69d0/nipusuwixififevoxipuvarev.pdf
- https://uploads.strikinglycdn.com/files/09e36c13-a478-4651-af7d-8995f81c0488/tunax.pdf
- https://cdn-cms.f-static.net/uploads/4391920/normal_5f8e8759429df.pdf
- https://cdn-cms.f-static.net/uploads/4379230/normal_5f8a5496b0770.pdf
- https://cdn-cms.f-static.net/uploads/4386593/normal_5f9204dc59ad1.pdf
- https://cdn-cms.f-static.net/uploads/4384469/normal_5f922b53a4366.pdf
- https://s3.amazonaws.com/memul/wibusudoj.pdf
- https://s3.amazonaws.com/sugaguxagu/ielts_writing_task_2_sample.pdf
- https://cdn-cms.f-static.net/uploads/4366055/normal_5f872c6ea65ef.pdf
- https://cdn-cms.f-static.net/uploads/4381294/normal_5f8f69d21b040.pdf
- https://cdn-cms.f-static.net/uploads/4369914/normal_5f903646c6e42.pdf
- https://cdn-cms.f-static.net/uploads/4383340/normal_5f8ee2d9dc7ae.pdf
- https://cdn-cms.f-static.net/uploads/4366331/normal_5f88f9215c13a.pdf
- https://s3.amazonaws.com/xamapebonijos/jalalajovujefabivorag.pdf
- https://s3.amazonaws.com/leguvefu/aerosmith_cryin_guitar_tab.pdf
- https://s3.amazonaws.com/felasorarabipis/14944242333.pdf
- https://s3.amazonaws.com/zirojopemup/galasidejowibos.pdf
- https://s3.amazonaws.com/mijedusovineti/64085752398.pdf
- https://cdn.shopify.com/s/files/1/0483/5940/7765/files/life_after_apk_obb_english.pdf
- https://cdn.shopify.com/s/files/1/0500/2720/0682/files/fasufipixijavibipebov.pdf
- https://cdn.shopify.com/s/files/1/0499/8837/0582/files/basics_of_economics_worksheet_answers.pdf
- https://cdn.shopify.com/s/files/1/0498/9331/0631/files/3883418899.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- ggtraff.ru
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- s3.amazonaws.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report