SUSPICIOUS — normal_5f8b5cf6af8dd.pdf
SUSPICIOUS — normal_5f8b5cf6af8dd.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
c2735cbfac5f67a7adb541c13e15436ba29c924da4a30eac8b9a66616f0fd1aa - SHA-1:
75de5047ffb4289f3efe861dbd13435eaf153170 - MD5:
2f7da088e789b4decb71c47e9aaaa374 - ssdeep:
1536:MGFwpPPW57pylIPsbsHlymHPBvZbsGde18yRGaA:pFwpma5sHlymHZvZbPihS - TLSH:
T122359FF350A3DD4D768F9F53ADAA11BD708AD78C61269A6108CC3B2DC47CAAE2F00554 - Submitted as: normal_5f8b5cf6af8dd.pdf
- File type: pdf · Size: 62408 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.com/123?keyword=ncp+vpn+client+premium+apk, https://cdn-cms.f-static.net/uploads/4379603/normal_5f8b5b6d416b9.pdf, https://cdn-cms.f-static.net/uploads/4365628/normal_5f8b496a9dd1d.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.com/123?keyword=ncp+vpn+client+premium+apk
- https://cdn-cms.f-static.net/uploads/4379603/normal_5f8b5b6d416b9.pdf
- https://cdn-cms.f-static.net/uploads/4365628/normal_5f8b496a9dd1d.pdf
- https://cdn-cms.f-static.net/uploads/4365655/normal_5f88ac5c5100d.pdf
- https://cdn.shopify.com/s/files/1/0492/3742/6342/files/latin_american_model.pdf
- https://cdn.shopify.com/s/files/1/0482/7172/0606/files/wizard_build_diablo_3_hydra.pdf
- https://cdn.shopify.com/s/files/1/0438/6629/2389/files/sinipisisa.pdf
- https://cdn-cms.f-static.net/uploads/4367937/normal_5f89f1d9e9e1f.pdf
- https://cdn-cms.f-static.net/uploads/4375086/normal_5f8b5beb9a36c.pdf
- https://cdn-cms.f-static.net/uploads/4375699/normal_5f899ff865660.pdf
- https://cdn.shopify.com/s/files/1/0483/5314/9081/files/orders_from_azshara_altar.pdf
- https://cdn.shopify.com/s/files/1/0466/2591/5045/files/32921582176.pdf
- https://cdn.shopify.com/s/files/1/0493/0640/2975/files/21308428320.pdf
- https://cdn.shopify.com/s/files/1/0431/8344/0036/files/luffy_gear_3_figure.pdf
- https://cdn.shopify.com/s/files/1/0266/7898/4878/files/dcp-l2520dw_toner_reset.pdf
- https://cdn-cms.f-static.net/uploads/4366362/normal_5f889e8dcf033.pdf
- https://cdn-cms.f-static.net/uploads/4366311/normal_5f8b2fcf163e9.pdf
- https://cdn-cms.f-static.net/uploads/4379742/normal_5f8afcd969f76.pdf
- https://cdn-cms.f-static.net/uploads/4380539/normal_5f8ac3679cc81.pdf
- https://cdn-cms.f-static.net/uploads/4369762/normal_5f8a67b7e5520.pdf
- https://cdn-cms.f-static.net/uploads/4368772/normal_5f8b5b9d69644.pdf
- https://cdn-cms.f-static.net/uploads/4378410/normal_5f8b2d717f660.pdf
- https://cdn-cms.f-static.net/uploads/4368495/normal_5f8a9b97ca606.pdf
- https://cdn-cms.f-static.net/uploads/4380695/normal_5f8b5c5bb8e2b.pdf
- https://cdn-cms.f-static.net/uploads/4367303/normal_5f877f2749721.pdf
Embedded domains
- ttraff.com
- cdn-cms.f-static.net
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report