SUSPICIOUS — normal_5f88947bde7bf.pdf
SUSPICIOUS — normal_5f88947bde7bf.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
9517ddafc5705f14d66280b412353b4c336f9728e5e2d8a783eaa7ccb11670ef - SHA-1:
0952efdf38da3303a46e05548425d37a4b75f6a9 - MD5:
e8db589ace68162b09a5d999203b66cb - ssdeep:
768:ogGzpDLpYUhXgCS4BgJvjk8euPIfV4Ww/kAa0c/J58EJVCEuXPwfBwO7G68x8S:lGFPpYOXdy2///BhKPs72x8S - TLSH:
T11C329EF3209BED4C7A8BEB036DAE249D5089E7496132E7605898276CD47C3BD7F11A10 - Submitted as: normal_5f88947bde7bf.pdf
- File type: pdf · Size: 47303 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/123?keyword=13+colonies+worksheets+high+school, https://cdn-cms.f-static.net/uploads/4367283/normal_5f8873d7dd6b3.pdf, https://cdn-cms.f-static.net/uploads/4366033/normal_5f87095ec4961.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=13+colonies+worksheets+high+school
- https://cdn-cms.f-static.net/uploads/4367283/normal_5f8873d7dd6b3.pdf
- https://cdn-cms.f-static.net/uploads/4366033/normal_5f87095ec4961.pdf
- https://cdn-cms.f-static.net/uploads/4366655/normal_5f875471d8d5c.pdf
- https://cdn-cms.f-static.net/uploads/4370269/normal_5f88761e8a368.pdf
- https://cdn-cms.f-static.net/uploads/4368759/normal_5f8845e071d4d.pdf
- https://site-1038572.mozfiles.com/files/1038572/61447105294.pdf
- https://site-1036761.mozfiles.com/files/1036761/78972462691.pdf
- https://site-1040095.mozfiles.com/files/1040095/purafepa.pdf
- https://site-1040506.mozfiles.com/files/1040506/1311176169.pdf
- https://site-1039539.mozfiles.com/files/1039539/18593284937.pdf
- https://cdn.shopify.com/s/files/1/0487/9371/4853/files/the_constitution_ws_guided_reading_activity_section_1.pdf
- https://cdn.shopify.com/s/files/1/0463/1062/1341/files/28418183612.pdf
- https://cdn.shopify.com/s/files/1/0465/0323/1646/files/kedesopibomokeruloreda.pdf
- https://cdn.shopify.com/s/files/1/0434/2382/6085/files/riximijetu.pdf
- https://cdn.shopify.com/s/files/1/0430/3850/7169/files/tubowasupat.pdf
- https://site-1042844.mozfiles.com/files/1042844/defixolaxilivuvegotam.pdf
- https://site-1039903.mozfiles.com/files/1039903/nivuledakulafazu.pdf
- https://site-1040562.mozfiles.com/files/1040562/55740644047.pdf
- https://uploads.strikinglycdn.com/files/1bfc3058-211f-4439-b71a-f400ce0b5f66/40403492108.pdf
- https://uploads.strikinglycdn.com/files/1a730215-2569-4196-b3d0-3dd66cc1e23b/21349579832.pdf
- https://cdn.shopify.com/s/files/1/0266/8970/0010/files/52115735397.pdf
- https://cdn.shopify.com/s/files/1/0496/1527/4147/files/vepiledul.pdf
- https://cdn.shopify.com/s/files/1/0483/8896/4503/files/brandon_elementary_school_calendar.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- site-1038572.mozfiles.com
- site-1036761.mozfiles.com
- site-1040095.mozfiles.com
- site-1040506.mozfiles.com
- site-1039539.mozfiles.com
- cdn.shopify.com
- site-1042844.mozfiles.com
- site-1039903.mozfiles.com
- site-1040562.mozfiles.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report