SUSPICIOUS — normal_5f87884f8e171.pdf
SUSPICIOUS — normal_5f87884f8e171.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
a95092b88b2a4ba86137bfea6819d63b5b6426555e181bb99f2fec9419600b40 - SHA-1:
5cd111b21faef9ae8ebade35f28890e4a154c8e1 - MD5:
ad8a21a7934ccbfb1a900d4b57e3cca8 - ssdeep:
768:+gGzpDKpccUUkPyxLJdVzfyaCRLeFVdceyN2Z6FxGRjRzxs3rhvI1HxY6JXmBXA4:7GFWp1zZf/xs3FCY6lAX/B0JyF - TLSH:
T10E328DF314E7EE4C7A879B53ACA711A56489D348A237DBA0408C362DD8BC2BD7F50460 - Submitted as: normal_5f87884f8e171.pdf
- File type: pdf · Size: 47315 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/8412cf42-088f-43fc-9eeb-36dc78ad5391/vobipenatejeburiso.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://gettraff.ru/123?keyword=iron+man+coloring+sheet+pdf, https://cdn.shopify.com/s/files/1/0501/7347/7052/files/oramento_geral_do_estado_angolano_2020.pdf, https://cdn.shopify.com/s/files/1/0432/5310/4790/files/97770346844.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://gettraff.ru/123?keyword=iron+man+coloring+sheet+pdf
- https://cdn.shopify.com/s/files/1/0501/7347/7052/files/oramento_geral_do_estado_angolano_2020.pdf
- https://cdn.shopify.com/s/files/1/0432/5310/4790/files/97770346844.pdf
- https://cdn.shopify.com/s/files/1/0477/1954/7036/files/high_sierra_elite_backpack_review.pdf
- https://cdn.shopify.com/s/files/1/0484/7996/1249/files/my_hy_vee_survey.pdf
- https://cdn.shopify.com/s/files/1/0497/8570/0519/files/50787351621.pdf
- https://cdn.shopify.com/s/files/1/0497/2324/4705/files/wezevofum.pdf
- https://cdn.shopify.com/s/files/1/0500/1602/6815/files/66189065291.pdf
- https://cdn.shopify.com/s/files/1/0496/4732/1237/files/7085101866.pdf
- https://cdn.shopify.com/s/files/1/0462/2372/0602/files/dexikipoxupuxaj.pdf
- https://cdn.shopify.com/s/files/1/0484/6249/5894/files/getosebizolefafeg.pdf
- https://cdn-cms.f-static.net/uploads/4367289/normal_5f873b2a08677.pdf
- https://cdn-cms.f-static.net/uploads/4365575/normal_5f87096c3b069.pdf
- https://cdn-cms.f-static.net/uploads/4365620/normal_5f874790799e3.pdf
- https://cdn-cms.f-static.net/uploads/4366965/normal_5f8786731f598.pdf
- https://cdn-cms.f-static.net/uploads/4365634/normal_5f8769731d368.pdf
- https://uploads.strikinglycdn.com/files/79152cd1-20ef-4229-87fe-1feb2bf13712/sitawas.pdf
- https://uploads.strikinglycdn.com/files/e1632df1-2fbd-4ae0-85cf-bdf832cded23/30767937588.pdf
- https://uploads.strikinglycdn.com/files/8412cf42-088f-43fc-9eeb-36dc78ad5391/vobipenatejeburiso.pdf
- https://uploads.strikinglycdn.com/files/49a4e40a-fb1b-4365-aef5-6d93a288e413/73085141325.pdf
- https://cdn-cms.f-static.net/uploads/4366311/normal_5f872acd202e6.pdf
- https://cdn-cms.f-static.net/uploads/4366034/normal_5f86f92933dbf.pdf
- https://cdn-cms.f-static.net/uploads/4366347/normal_5f87753c1d754.pdf
- https://cdn-cms.f-static.net/uploads/4365594/normal_5f8778fab7581.pdf
- https://cdn-cms.f-static.net/uploads/4367640/normal_5f87871d27a15.pdf
Embedded domains
- gettraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report