SUSPICIOUS — normal_5fa692f0a4690.pdf

SUSPICIOUS — normal_5fa692f0a4690.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: a37d7bdd0f42e40cd1b5c86502f70bb5ddb084c5dca7f9ef3ae3b054bcc160e9
• SHA-1: 2f1860668e59bcb454a16d367c20c8db40a513d2
• MD5: e54f2a5a06f44d58a494c638b73a4a88
• ssdeep: 768:hgGzpDcwYX8MRRvm5j2micbWg91UBfEqGHBwB:SGFgkjLbWUKEdHBwB
• TLSH: T11131C0F761A7DE8D7B869B439DF6005A6486E68C1033A67408C87B2CC8BC5FC6E10921
• Submitted as: normal_5fa692f0a4690.pdf
• File type: pdf · Size: 41442 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://traffking.ru/123?keyword=movie+rulz+free+com, https://wipaluxeko.weebly.com/uploads/1/3/4/3/134346688/mowebazes.pdf, https://cdn-cms.f-static.net/uploads/4366639/normal_5f8bfa21c8164.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://traffking.ru/123?keyword=movie+rulz+free+com
• https://rotadenig.files.wordpress.com/2020/11/82236523173.pdf
• https://s3.amazonaws.com/bikikanafopavu/xuruji.pdf
• https://dilopipo.files.wordpress.com/2020/11/demetivudaxakoleze.pdf
• https://wipaluxeko.weebly.com/uploads/1/3/4/3/134346688/mowebazes.pdf
• https://cdn-cms.f-static.net/uploads/4366639/normal_5f8bfa21c8164.pdf
• https://s3.amazonaws.com/henghuili-files2/42281496850.pdf
• https://xeponadutowa.weebly.com/uploads/1/3/4/6/134612209/2026334.pdf
• https://s3.amazonaws.com/xalasawu/is_square_tube_measured_id_or_od.pdf
• https://sufuvuse.files.wordpress.com/2020/11/3074016501.pdf
• https://s3.amazonaws.com/debamijizozexo/sanatinunituzuzikojun.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffking.ru
• rotadenig.files.wordpress.com
• s3.amazonaws.com
• dilopipo.files.wordpress.com
• wipaluxeko.weebly.com
• cdn-cms.f-static.net
• xeponadutowa.weebly.com
• sufuvuse.files.wordpress.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report