SUSPICIOUS — normal_5fa389919595d.pdf

SUSPICIOUS — normal_5fa389919595d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: b2974d1ba0772227e8e15e2b5dd6a0f3e692de3446db1896460e827e34d0ce05
• SHA-1: 2464624a32972f9d456b6d40718911bd1ec11e18
• MD5: 42c160a6c3a5c1da2ce40516646f4da1
• ssdeep: 768:ggGzpDmtXM02A5iZD3vBoRvFEkmNaLtTKAv1CjWyQVO94sPJMFJo7PnmDW:tGFy2A5iZD3s9tTKALyQV2dDnmDW
• TLSH: T1C7319DF34067DC8C7ACB9B076EEA1448144AC79D3136A22069DDB77C847C2AD7E109B1
• Submitted as: normal_5fa389919595d.pdf
• File type: pdf · Size: 42017 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ttraff.link/123?keyword=2010+nissan+frontier+repair+manual+free, https://cdn-cms.f-static.net/uploads/4408348/normal_5f9cd2bc103ba.pdf, https://firedisivimi.weebly.com/uploads/1/3/0/9/130969818/zalawumavujiv.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/123?keyword=2010+nissan+frontier+repair+manual+free
• https://s3.amazonaws.com/biwuwukesazef/54155997447.pdf
• https://s3.amazonaws.com/fatikonavori/63405702846.pdf
• https://cdn-cms.f-static.net/uploads/4408348/normal_5f9cd2bc103ba.pdf
• https://s3.amazonaws.com/pibabopuduj/gusisevazetoferigi.pdf
• https://s3.amazonaws.com/wewuxuviwar/allen_carr_easy_way.pdf
• https://s3.amazonaws.com/ruzaganog/hyatt_tysons_corner_club_lounge.pdf
• https://s3.amazonaws.com/gujutavevive/close_to_you_carpenters_chords.pdf
• https://firedisivimi.weebly.com/uploads/1/3/0/9/130969818/zalawumavujiv.pdf
• https://s3.amazonaws.com/napejaxosinages/99926856468.pdf
• https://s3.amazonaws.com/mefovu/jataled.pdf
• https://s3.amazonaws.com/julaxel/1793153351.pdf
• https://xusawoji.weebly.com/uploads/1/3/0/7/130739635/cb68646f26c8436.pdf
• https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/gapovowumepekegosiza.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• s3.amazonaws.com
• cdn-cms.f-static.net
• firedisivimi.weebly.com
• xusawoji.weebly.com
• genigudepa.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report