SUSPICIOUS — normal_5fa0823d4ecb4.pdf

SUSPICIOUS — normal_5fa0823d4ecb4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 9cb6b9ad52d6fd916e41547fa607c57272c0071984b1f095515771de7ea767c2
• SHA-1: b4b3413bb76f3145072512269a7098e711713e01
• MD5: e0abd6197b3344a06017285901742294
• ssdeep: 768:MgGzpDTzTYCeMtuEpuVzZ1wz8LJAZ4p0pEDxkxEhcIlk:JGFXLQA4LSZ4p/kxEcIlk
• TLSH: T17C309DF70067DC9C7999EB036DA6241950C9C9897137A62059C93B7CD8BCBBCAE10A31
• Submitted as: normal_5fa0823d4ecb4.pdf
• File type: pdf · Size: 35846 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/123?keyword=king+richard+motel+warren+mi, https://cdn.shopify.com/s/files/1/0501/7963/7438/files/gibomozuki.pdf, https://uploads.strikinglycdn.com/files/872bb959-04d9-4da4-a451-8eda12416aeb/noramolanazusufuzar.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/123?keyword=king+richard+motel+warren+mi
• https://s3.amazonaws.com/dudurat/repair_manual_2003_mitsubishi_montero_sport.pdf
• https://s3.amazonaws.com/falevi/vuziwovuwiputu.pdf
• https://cdn.shopify.com/s/files/1/0501/7963/7438/files/gibomozuki.pdf
• https://s3.amazonaws.com/mexavofezoxi/situn.pdf
• https://uploads.strikinglycdn.com/files/872bb959-04d9-4da4-a451-8eda12416aeb/noramolanazusufuzar.pdf
• https://cdn.shopify.com/s/files/1/0482/0126/9405/files/log_splitter_wedge_material.pdf
• https://cdn.shopify.com/s/files/1/0503/6503/8744/files/faxifegazerokenijini.pdf
• https://uploads.strikinglycdn.com/files/cbbd5254-e42c-4fe5-a217-248289de1515/31322823901.pdf
• https://s3.amazonaws.com/megelugik/tenozobakakito.pdf
• https://s3.amazonaws.com/fomaralunex/yellow_jacket_broadband_internet.pdf
• https://s3.amazonaws.com/pibabopuduj/46706427884.pdf
• https://cdn-cms.f-static.net/uploads/4386842/normal_5f97611ee0724.pdf
• https://cdn.shopify.com/s/files/1/0506/8528/0449/files/2d_driving_simulator_geoquake.pdf
• https://cdn.shopify.com/s/files/1/0501/5027/7301/files/5270763.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• s3.amazonaws.com
• cdn.shopify.com
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report