SUSPICIOUS — normal_5f899f28ec180.pdf
SUSPICIOUS — normal_5f899f28ec180.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
bdd4d9ed627a3ee3ceb85a74f88238672fb0a5087e701e3fde7087e8750cca32 - SHA-1:
8e6dd7c1ac63cfae82684707f7a8d8dbd04d0dfb - MD5:
473d8f1a589d5aa79c0f559b52c3f69b - ssdeep:
1536:qGFrpBizI3VKzzk4YGZ6o2Ju293h4WIXMovkrE73ZQN+93ck:TFrpB9/Cm932bM4brTf - TLSH:
T1BC36BEF311A7DD4C7A8367639D6726AA618EC7886133D7A0458C766CC57CABC3F10920 - Submitted as: normal_5f899f28ec180.pdf
- File type: pdf · Size: 67896 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://cdn-cms.f-static.net/uploads/4365621/normal_5f8759a725fb8.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ttraff.club/123?keyword=android+expandablelistview+always+expanded, https://cdn-cms.f-static.net/uploads/4370273/normal_5f885724a9dfd.pdf, https://cdn-cms.f-static.net/uploads/4366398/normal_5f8945427954b.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.club/123?keyword=android+expandablelistview+always+expanded
- https://cdn-cms.f-static.net/uploads/4370273/normal_5f885724a9dfd.pdf
- https://cdn-cms.f-static.net/uploads/4366398/normal_5f8945427954b.pdf
- https://cdn-cms.f-static.net/uploads/4374984/normal_5f89981c00ca6.pdf
- https://cdn-cms.f-static.net/uploads/4369506/normal_5f87c8f92ae27.pdf
- https://cdn-cms.f-static.net/uploads/4365546/normal_5f8719e74da85.pdf
- https://cdn.shopify.com/s/files/1/0483/5613/0965/files/descargar_minecraft_apk_full_espaol_gratis.pdf
- https://cdn.shopify.com/s/files/1/0501/0882/5795/files/41725555093.pdf
- https://cdn.shopify.com/s/files/1/0477/8803/2159/files/bamusovomezozeneluxejat.pdf
- https://cdn.shopify.com/s/files/1/0437/4685/3016/files/ecs_mcp61pm-hm_manual.pdf
- https://cdn.shopify.com/s/files/1/0498/2240/0674/files/jewagatevoxeribaba.pdf
- https://cdn-cms.f-static.net/uploads/4368469/normal_5f87dfc7b0de1.pdf
- https://cdn-cms.f-static.net/uploads/4365621/normal_5f8759a725fb8.pdf
- https://cdn-cms.f-static.net/uploads/4365582/normal_5f87204e36362.pdf
- https://cdn.shopify.com/s/files/1/0429/7090/6780/files/types_of_case_tools.pdf
- https://cdn.shopify.com/s/files/1/0432/3121/5774/files/dutailier_replacement_cushions_amazon.pdf
- https://cdn.shopify.com/s/files/1/0479/0281/8471/files/kikifenujefalipe.pdf
- https://cdn.shopify.com/s/files/1/0432/3049/4878/files/zuvifunejunobuvemesalag.pdf
- https://vopevejefed.weebly.com/uploads/1/3/1/6/131606133/8af7d8b8d4913.pdf
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/1515306.pdf
- https://wekubuzebebam.weebly.com/uploads/1/3/0/7/130739705/zaduliko.pdf
- https://folarudivol.weebly.com/uploads/1/3/1/8/131871739/908d89f.pdf
- https://ligofaxudatejot.weebly.com/uploads/1/3/0/7/130739538/gumoxikikup_pexokeper.pdf
- https://cdn.shopify.com/s/files/1/0497/4739/4714/files/dizejifutazuzu.pdf
- https://cdn.shopify.com/s/files/1/0484/3654/3656/files/mubusevujomesit.pdf
Embedded domains
- ttraff.club
- cdn-cms.f-static.net
- cdn.shopify.com
- vopevejefed.weebly.com
- dutitujazekap.weebly.com
- wekubuzebebam.weebly.com
- folarudivol.weebly.com
- ligofaxudatejot.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report