SUSPICIOUS — normal_5f9f9fadd5967.pdf

SUSPICIOUS — normal_5f9f9fadd5967.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: b23c9cb8e8e2102eb76941a8a113464ad7e76a2ed8282ad784756c171aa0e8d6
• SHA-1: dc4bd7d149a74921db0d646fbac9d8eace97e7ee
• MD5: 65d34f65f50490cc4887801058bcaa97
• ssdeep: 768:agGzpDNsZyDypzfp0ZkDn2jUhqi6MJBFQ3yu2Dpm5dxQ:HGF5sHT2jUEZ6s4s5dxQ
• TLSH: T127307DF7815BED8D7F8A9B039DB61059204EC3886133D6A419D97B7DC4FC1ADAE10A20
• Submitted as: normal_5f9f9fadd5967.pdf
• File type: pdf · Size: 35946 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ttraff.me/123?keyword=manual+valve+body+for+700r4+transmission, https://uploads.strikinglycdn.com/files/20b4c05a-d5d9-4de7-90ac-7f4fd07ccdd8/33750951699.pdf, https://uploads.strikinglycdn.com/files/6bf8f9b5-6e45-4943-9900-7262bba2797f/basuxizawunurul.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ttraff.me/123?keyword=manual+valve+body+for+700r4+transmission
• https://s3.amazonaws.com/saxefi/vibiwogokewuxafadimi.pdf
• https://uploads.strikinglycdn.com/files/20b4c05a-d5d9-4de7-90ac-7f4fd07ccdd8/33750951699.pdf
• https://s3.amazonaws.com/likadojivivofu/66973240074.pdf
• https://uploads.strikinglycdn.com/files/6bf8f9b5-6e45-4943-9900-7262bba2797f/basuxizawunurul.pdf
• https://uploads.strikinglycdn.com/files/d6701baf-12c4-4c1a-a601-aeb810e9e29c/zetajisufir.pdf
• https://s3.amazonaws.com/xipavir/dowling_catholic_football_score.pdf
• https://s3.amazonaws.com/susopuzupure/88184356423.pdf
• https://cdn-cms.f-static.net/uploads/4422622/normal_5f96f5a036d4a.pdf
• https://cdn-cms.f-static.net/uploads/4380079/normal_5f99297e956fd.pdf
• https://cdn-cms.f-static.net/uploads/4393358/normal_5f9cf1d89122e.pdf
• https://s3.amazonaws.com/tadovu/terraria_apk_hiapphere.pdf
• https://cdn-cms.f-static.net/uploads/4402951/normal_5f9cae6d3a88f.pdf
• https://cdn-cms.f-static.net/uploads/4366331/normal_5f9bf40dbb9fa.pdf
• https://s3.amazonaws.com/kavitokolezub/juxaxapenavo.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• s3.amazonaws.com
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report