MALICIOUS — normal_5f92cc796ca21.pdf
MALICIOUS — normal_5f92cc796ca21.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
a3aea52b8760d3a844cd8af8984b1069219b394817d9f250c2189605a9f62249 - SHA-1:
ef3ea8028459bc37d385a87268b9e94b0b96c34c - MD5:
5b74ec7e1f989e38af8ac8a7375fae77 - ssdeep:
768:NCgGzpDAee4VRDyODbrQ5WNK+PITHTTGWJvoU8jFdWD2dz0jCkOxV1fqOHSYPmen:FGF0X4VpN1wTzTiwSS+/5w8Js5gvqy - TLSH:
T14434AEE35197ED4D7A8F1B13EE671159A4CADB8C60369BA0058C672CC4BC6FD2F00A25 - Submitted as: normal_5f92cc796ca21.pdf
- File type: pdf · Size: 54651 bytes
- Verdict: malicious (75/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://cdn-cms.f-static.net/uploads/4365652/normal_5f86fc063be65.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ttraff.me/123?keyword=the+godfather+game+android+gift+code, https://cdn-cms.f-static.net/uploads/4374188/normal_5f8ee5158b25b.pdf, https://cdn-cms.f-static.net/uploads/4379987/normal_5f8ca893be19e.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.me/123?keyword=the+godfather+game+android+gift+code
- https://cdn-cms.f-static.net/uploads/4374188/normal_5f8ee5158b25b.pdf
- https://cdn-cms.f-static.net/uploads/4379987/normal_5f8ca893be19e.pdf
- https://cdn-cms.f-static.net/uploads/4390643/normal_5f8f029bde884.pdf
- https://cdn-cms.f-static.net/uploads/4375206/normal_5f92941f7b5f5.pdf
- https://cdn-cms.f-static.net/uploads/4383131/normal_5f8d84a94ebce.pdf
- https://cdn-cms.f-static.net/uploads/4365652/normal_5f86fc063be65.pdf
- https://cdn-cms.f-static.net/uploads/4383327/normal_5f8c82f1d2534.pdf
- https://cdn-cms.f-static.net/uploads/4372378/normal_5f89c45f4bfb0.pdf
- https://cdn-cms.f-static.net/uploads/4408184/normal_5f922e827c026.pdf
- https://s3.amazonaws.com/ribowexulo/91612572438.pdf
- https://s3.amazonaws.com/rovikibixu/calculus_12_textbook.pdf
- https://s3.amazonaws.com/forupokisip/radojikarudijofebefoduwu.pdf
- https://s3.amazonaws.com/xanebavifamopez/coreldraw_2018_shortcut_keys_download.pdf
- https://s3.amazonaws.com/felasorarabipis/42209633553.pdf
- https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/8980310.pdf
- https://finazodaxuvoj.weebly.com/uploads/1/3/2/6/132682535/9300333.pdf
- https://daletutanedura.weebly.com/uploads/1/3/1/6/131636587/jogaki-nanasumabirapi-wapezuz-tulujawegagokif.pdf
- https://latenenagizogip.weebly.com/uploads/1/3/2/6/132696064/56bb24b4d72.pdf
- https://mipirizu.weebly.com/uploads/1/3/2/6/132682564/kuwoxujigebek.pdf
- https://cdn-cms.f-static.net/uploads/4367617/normal_5f895c33e0ecd.pdf
- https://cdn-cms.f-static.net/uploads/4373788/normal_5f8b3747259ea.pdf
- https://uploads.strikinglycdn.com/files/a87b559d-b33d-4346-8997-5f821c76b31e/firaxapedesadozeveboruxi.pdf
- https://uploads.strikinglycdn.com/files/3b4e7323-76aa-4cbe-bed3-ea731c40db1f/19395949062.pdf
- https://uploads.strikinglycdn.com/files/22247ffd-cdf8-4c93-9524-aa3aee09f107/pitimisijezarokabato.pdf
Embedded domains
- ttraff.me
- cdn-cms.f-static.net
- s3.amazonaws.com
- vuxozajuje.weebly.com
- finazodaxuvoj.weebly.com
- daletutanedura.weebly.com
- latenenagizogip.weebly.com
- mipirizu.weebly.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report