SUSPICIOUS — normal_5f992fb25bf0b.pdf
SUSPICIOUS — normal_5f992fb25bf0b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
b5972f67e38d5dbca95b956ccdac70da40044833f380906979d584ef8f9b2ec2 - SHA-1:
bb8b0a03873638e55ca413943c528847d42b017e - MD5:
203046de46a419abb857d8ab042e7a0f - ssdeep:
768:CgGzpD5FptFjIiKe7LVDzfXLnfrXbcjYUpLx6Ax2mBDcZ:fGFtFptFHrcjYeLx6C2mQZ - TLSH:
T122306CF350ABEE8C768FAB176DA701AC7449D3CD6132A7900499772CC57C9EC2E04A64 - Submitted as: normal_5f992fb25bf0b.pdf
- File type: pdf · Size: 36669 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.me/123?keyword=klean+strip+denatured+alcohol+5+gallon, https://cdn-cms.f-static.net/uploads/4385633/normal_5f8f5039cb80e.pdf, https://cdn-cms.f-static.net/uploads/4367923/normal_5f8af320623cf.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.me/123?keyword=klean+strip+denatured+alcohol+5+gallon
- https://cdn-cms.f-static.net/uploads/4385633/normal_5f8f5039cb80e.pdf
- https://cdn-cms.f-static.net/uploads/4367923/normal_5f8af320623cf.pdf
- https://cdn-cms.f-static.net/uploads/4366335/normal_5f87174c5a723.pdf
- https://cdn-cms.f-static.net/uploads/4385213/normal_5f8f8f0793608.pdf
- https://cdn-cms.f-static.net/uploads/4366029/normal_5f8b7d966f725.pdf
- https://cdn-cms.f-static.net/uploads/4379030/normal_5f94645909ff5.pdf
- https://cdn-cms.f-static.net/uploads/4374968/normal_5f98f43bc00bd.pdf
- https://cdn-cms.f-static.net/uploads/4369922/normal_5f99016ba45ae.pdf
- https://cdn-cms.f-static.net/uploads/4383930/normal_5f8c9a98c70eb.pdf
- https://cdn.shopify.com/s/files/1/0498/4494/5051/files/all_souls_the_book_of_life.pdf
- https://cdn.shopify.com/s/files/1/0498/5625/0013/files/dashdaq_xl_manual.pdf
- https://cdn.shopify.com/s/files/1/0434/2536/6165/files/jedubitipuz.pdf
- https://s3.amazonaws.com/levumoduf/fejalekapido.pdf
- https://s3.amazonaws.com/kizugokofo/design_e_comunicao_visual_bruno_munari_download.pdf
- https://s3.amazonaws.com/fasanag/tugojosarejawopex.pdf
- https://xigepeseforala.weebly.com/uploads/1/3/4/5/134508125/katiworuxiwo_sepamim_turigobo_xamogijopumano.pdf
- https://vajibudutoneraz.weebly.com/uploads/1/3/4/3/134345344/giwofe.pdf
- https://daletutanedura.weebly.com/uploads/1/3/1/6/131636587/tizunivatuvesiduma.pdf
- https://xubuvene.weebly.com/uploads/1/3/1/3/131380433/865368d66db3.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- ttraff.me
- cdn-cms.f-static.net
- cdn.shopify.com
- s3.amazonaws.com
- xigepeseforala.weebly.com
- vajibudutoneraz.weebly.com
- daletutanedura.weebly.com
- xubuvene.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report