SUSPICIOUS — normal_5f884b692a2d5.pdf
SUSPICIOUS — normal_5f884b692a2d5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
bfa72d98310d9497a432980e6bb60f715c7e8f41b05089f2edeec0c44e985ba2 - SHA-1:
62bcaed5812a2d8e628a6c4ae8da7d5be20f39a1 - MD5:
0be4fecd50175a1517a1a3631cf1fa56 - ssdeep:
768:rgGzpDqpYn2niNguqZd63q3jaMuOvRGETQ3Yl5O4lRxza4trRdUNRLQ/cR/5:UGFWpYW5hzxznrRsuS/5 - TLSH:
T147305DF364DBED4C7A87DB53ACA71664648DD388A232AB90448C2B6CD47C67D3F10960 - Submitted as: normal_5f884b692a2d5.pdf
- File type: pdf · Size: 36609 bytes
- Verdict: suspicious (35/100)
Detections (2 of 50 engines)
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/123?keyword=geometria+plana+livros+pdf, https://cdn.shopify.com/s/files/1/0440/6748/7894/files/fujafupabagejome.pdf, https://cdn.shopify.com/s/files/1/0496/7845/0840/files/saeco_odea_giro_service_manual.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=geometria+plana+livros+pdf
- https://cdn.shopify.com/s/files/1/0440/6748/7894/files/fujafupabagejome.pdf
- https://cdn.shopify.com/s/files/1/0496/7845/0840/files/saeco_odea_giro_service_manual.pdf
- https://cdn.shopify.com/s/files/1/0467/9752/1047/files/rmw_2.2g24_rebuild_kit.pdf
- https://cdn.shopify.com/s/files/1/0480/5322/3588/files/zokupujodibodi.pdf
- https://cdn-cms.f-static.net/uploads/4366645/normal_5f883bd611509.pdf
- https://cdn-cms.f-static.net/uploads/4367951/normal_5f876896d36be.pdf
- https://cdn-cms.f-static.net/uploads/4368487/normal_5f87bde27219e.pdf
- https://cdn-cms.f-static.net/uploads/4367313/normal_5f87588aa564e.pdf
- https://cdn-cms.f-static.net/uploads/4367650/normal_5f8773241d908.pdf
- https://cdn-cms.f-static.net/uploads/4365542/normal_5f8710c8036e4.pdf
- https://cdn-cms.f-static.net/uploads/4366014/normal_5f8707e1aec9b.pdf
- https://cdn-cms.f-static.net/uploads/4368984/normal_5f88047986706.pdf
- https://cdn-cms.f-static.net/uploads/4366639/normal_5f87e17ae3d05.pdf
- https://cdn-cms.f-static.net/uploads/4368495/normal_5f8773e6b86fe.pdf
- https://cdn-cms.f-static.net/uploads/4365594/normal_5f877afd274c0.pdf
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f87429eb7974.pdf
- https://cdn-cms.f-static.net/uploads/4366965/normal_5f87f207bb821.pdf
- https://cdn-cms.f-static.net/uploads/4368969/normal_5f87aa85a584c.pdf
- https://cdn-cms.f-static.net/uploads/4368781/normal_5f8829959cee5.pdf
- https://site-1042286.mozfiles.com/files/1042286/84543538954.pdf
- https://site-1036823.mozfiles.com/files/1036823/61073000337.pdf
- https://site-1038759.mozfiles.com/files/1038759/kixefegopabu.pdf
- https://cdn-cms.f-static.net/uploads/4369786/normal_5f881fbd30866.pdf
- https://cdn-cms.f-static.net/uploads/4366405/normal_5f8802c5b9082.pdf
Embedded domains
- cctraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- site-1042286.mozfiles.com
- site-1036823.mozfiles.com
- site-1038759.mozfiles.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report