SUSPICIOUS — normal_5f89d48c8749e.pdf
SUSPICIOUS — normal_5f89d48c8749e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
bac64cdee00f27b0a220d6ce3f42e9e6601dc64adf18d6b8d22db4af6eb3ac5d - SHA-1:
5b22632e4ba0dee2a3f231eab358197138c22a66 - MD5:
c54cccb7aa3f28a04e16cf273b584e5f - ssdeep:
768:5gGzpDYpERnev5Ym/T1ZsuTo42GVsB/in31jtzc404UTylG/GfXymnCRkK1MaHYF:6GFEpEm31pN04DG/Gf8RkK1MaHUYDZ1+ - TLSH:
T1EF339DF754D7ED4C3E8A6F27AEEB12166585C7487122A790088C672CD4BC6BDBF10860 - Submitted as: normal_5f89d48c8749e.pdf
- File type: pdf · Size: 47926 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/123?keyword=discovery+learning+instructional+design+model, https://cdn-cms.f-static.net/uploads/4366043/normal_5f86f4fd927d8.pdf, https://cdn-cms.f-static.net/uploads/4370542/normal_5f89725bcf3a0.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=discovery+learning+instructional+design+model
- https://cdn-cms.f-static.net/uploads/4366043/normal_5f86f4fd927d8.pdf
- https://cdn-cms.f-static.net/uploads/4370542/normal_5f89725bcf3a0.pdf
- https://cdn-cms.f-static.net/uploads/4374533/normal_5f89813fc9852.pdf
- https://cdn-cms.f-static.net/uploads/4367645/normal_5f89b49a955d3.pdf
- https://cdn-cms.f-static.net/uploads/4368762/normal_5f89a69f3092c.pdf
- https://cdn-cms.f-static.net/uploads/4367925/normal_5f88a2d59bd2e.pdf
- https://cdn-cms.f-static.net/uploads/4365638/normal_5f87ec36b14b4.pdf
- https://cdn-cms.f-static.net/uploads/4373264/normal_5f89721dafea3.pdf
- https://uploads.strikinglycdn.com/files/8d8b9cc2-cf2c-467e-9152-6f30173dd8e4/dolexafuz.pdf
- https://uploads.strikinglycdn.com/files/966d5907-c81c-4b07-8c70-8728ac57c7bf/79050677361.pdf
- https://cdn-cms.f-static.net/uploads/4368249/normal_5f897d40ee3a0.pdf
- https://cdn-cms.f-static.net/uploads/4365661/normal_5f87799f22994.pdf
- https://cdn-cms.f-static.net/uploads/4367005/normal_5f873c72defd1.pdf
- https://cdn-cms.f-static.net/uploads/4365626/normal_5f872d5f8e44e.pdf
- https://cdn-cms.f-static.net/uploads/4365545/normal_5f88278c5ff0f.pdf
- https://cdn-cms.f-static.net/uploads/4365583/normal_5f8706e71edb1.pdf
- https://cdn-cms.f-static.net/uploads/4366306/normal_5f87199501de1.pdf
- https://cdn.shopify.com/s/files/1/0497/2783/2221/files/isosceles_trapezoid_worksheet.pdf
- https://cdn.shopify.com/s/files/1/0477/4694/1084/files/pokemon_tabletop_united_character_creation.pdf
- https://cdn.shopify.com/s/files/1/0434/8457/7956/files/mezebajalitekitotuvibinu.pdf
- https://cdn.shopify.com/s/files/1/0486/2545/1173/files/joxagokegariwapiwesatalet.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report