SUSPICIOUS — normal_5f9a3555b6dbd.pdf
SUSPICIOUS — normal_5f9a3555b6dbd.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
bc71adc9a98bc531f8a0a7d483bf852a9398e0799e4909bbeb1c0bfabad0b905 - SHA-1:
051c9b2b8eb69603a2ac96c94f10a63661b69382 - MD5:
ef6da08feb7788890eb09a1a3cc97083 - ssdeep:
768:ggGzpD8+OUieawRuxcahbustOvmuZNofjlXIlMRmpf1uT/AN8:tGFYkxNah+mkNuWA2kAN8 - TLSH:
T1A5338DF750A7DC8CBB8A9B039DB61465A58ED7889132CBA0459C762CC8BC6FD7E10940 - Submitted as: normal_5f9a3555b6dbd.pdf
- File type: pdf · Size: 51405 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://kuguzozivef.weebly.com/uploads/1/3/0/7/130739994/lagopedobinobobixu.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ttraff.com/123?keyword=how+to+beat+the+lemonade+stand+game, https://kuguzozivef.weebly.com/uploads/1/3/0/7/130739994/lagopedobinobobixu.pdf, https://uploads.strikinglycdn.com/files/918925eb-3a07-451a-987e-1417e0434623/pibubobutirufigemupasules.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.com/123?keyword=how+to+beat+the+lemonade+stand+game
- https://kuguzozivef.weebly.com/uploads/1/3/0/7/130739994/lagopedobinobobixu.pdf
- https://uploads.strikinglycdn.com/files/918925eb-3a07-451a-987e-1417e0434623/pibubobutirufigemupasules.pdf
- https://wosowabo.weebly.com/uploads/1/3/4/3/134340570/2f5d938fdad2b0.pdf
- https://uploads.strikinglycdn.com/files/bde14095-f9f5-46be-8cf2-a5ba32984145/jizaguworutopijupuja.pdf
- https://uploads.strikinglycdn.com/files/8bb3f83e-d60a-46b5-86f8-de78e28c13e9/xavojexas.pdf
- https://uploads.strikinglycdn.com/files/957272e2-2764-456b-8761-cf19401d7af3/43521210348.pdf
- https://bakigimos.weebly.com/uploads/1/3/4/3/134322269/2551526.pdf
- https://nokiziwevapof.weebly.com/uploads/1/3/4/5/134507241/6590300.pdf
- https://uploads.strikinglycdn.com/files/a15826a4-8c81-45fc-9135-6602ef0ed64f/nabevo.pdf
- https://cdn.shopify.com/s/files/1/0499/4931/1131/files/shimano_altus_manual.pdf
- https://misutinulil.weebly.com/uploads/1/3/1/4/131407711/1610840.pdf
- https://uploads.strikinglycdn.com/files/0cb729cf-a882-46bf-a00e-05c4fd832224/63890706963.pdf
- https://jotuxopa.weebly.com/uploads/1/3/4/2/134265841/letexorapu_mesodekeduraj_jisizuxe_jorelevewuta.pdf
- https://kubuwexujilo.weebly.com/uploads/1/3/4/4/134473085/820de7339752.pdf
- https://fexatawolev.weebly.com/uploads/1/3/4/4/134445796/7824285.pdf
- https://uploads.strikinglycdn.com/files/0c00115c-daa3-4566-aedf-63d0fad02517/daniwofitajakekoxofajiw.pdf
- https://vozunutav.weebly.com/uploads/1/3/0/9/130969695/zuwerevufu_fakodo_wotinete_rajizelu.pdf
- https://uploads.strikinglycdn.com/files/95c11808-97ae-4358-ad58-71f6059bfaea/mysterious_shrine_pathfinder_kingmak.pdf
- https://folemazilepi.weebly.com/uploads/1/3/1/1/131164248/3470289.pdf
- https://zakiguranul.weebly.com/uploads/1/3/4/4/134480990/1308379.pdf
- https://cdn.shopify.com/s/files/1/0432/4845/1739/files/gezow.pdf
- https://vidigesiwixir.weebly.com/uploads/1/3/3/9/133997627/keporalet_dilozunuj_tisojal_xivadarad.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- ttraff.com
- kuguzozivef.weebly.com
- uploads.strikinglycdn.com
- wosowabo.weebly.com
- bakigimos.weebly.com
- nokiziwevapof.weebly.com
- cdn.shopify.com
- misutinulil.weebly.com
- jotuxopa.weebly.com
- kubuwexujilo.weebly.com
- fexatawolev.weebly.com
- vozunutav.weebly.com
- folemazilepi.weebly.com
- zakiguranul.weebly.com
- vidigesiwixir.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report