MALICIOUS — normal_5f86feb03f9ab.pdf
MALICIOUS — normal_5f86feb03f9ab.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 52 detection engines flagged it.
Identification
- SHA-256:
a4ab0939ba91a398947ecb0dde317811d9813cfaad92103af1e1ace738422d8e - SHA-1:
488a52a3174f347742243e6bc3220e646b90ede4 - MD5:
0cd1336fecb97f5198d61e575db2b88b - ssdeep:
768:tgGzpDgemiyBW/G2hKlPUNLEidFYn3YfOuEs+vJpUV+70UNhc3HL73hrJaE:OGFsemi1/G2mPUZfqJpUPCu3HLFrJaE - TLSH:
T11933AEF3506BEC8C7B8AEB175EE70059604ADA886123EA5054DC3B7CC5BC6BD7E40960 - Submitted as: normal_5f86feb03f9ab.pdf
- File type: pdf · Size: 51447 bytes
- Verdict: malicious (88/100)
Detections (3 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ggtraff.ru/123?keyword=avakin+life+mod+menu+apk+1.021.07, https://cdn.shopify.com/s/files/1/0432/6404/9318/files/whidbey_island_map.pdf, https://cdn.shopify.com/s/files/1/0431/0876/1751/files/truckee_high_school_sports.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=avakin+life+mod+menu+apk+1.021.07
- https://cdn.shopify.com/s/files/1/0432/6404/9318/files/whidbey_island_map.pdf
- https://cdn.shopify.com/s/files/1/0431/0876/1751/files/truckee_high_school_sports.pdf
- https://cdn.shopify.com/s/files/1/0430/7274/9721/files/craigslist_phoenix_cars.pdf
- https://cdn.shopify.com/s/files/1/0433/8778/1287/files/kexixeza.pdf
- https://cdn.shopify.com/s/files/1/0433/0464/8859/files/70014792933.pdf
- https://uploads.strikinglycdn.com/files/a3d09aa6-4a8e-4e33-a2a0-594d9a151c90/43002663201.pdf
- https://uploads.strikinglycdn.com/files/63795a11-1d58-48ca-8b90-7942c491f6a6/44140003460.pdf
- https://uploads.strikinglycdn.com/files/e3a38adb-6516-4ce4-978a-4a7622fce8c9/ziporoxibufoxovegakiw.pdf
- https://uploads.strikinglycdn.com/files/dd89a90c-c20b-46d6-ac25-837fa260e545/lupijafuwuvituremu.pdf
- https://cdn-cms.f-static.net/uploads/4365652/normal_5f86fc3c802af.pdf
- https://cdn-cms.f-static.net/uploads/4365657/normal_5f86f9835b85b.pdf
- https://cdn-cms.f-static.net/uploads/4365552/normal_5f86f7012c100.pdf
- https://cdn-cms.f-static.net/uploads/4365612/normal_5f86f49472131.pdf
- https://site-1038384.mozfiles.com/files/1038384/22437143780.pdf
- https://site-1037057.mozfiles.com/files/1037057/xesivorizib.pdf
- https://site-1040327.mozfiles.com/files/1040327/34775279547.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- site-1038384.mozfiles.com
- site-1037057.mozfiles.com
- site-1040327.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report