SUSPICIOUS — normal_5f8c3dead6294.pdf
SUSPICIOUS — normal_5f8c3dead6294.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
c332abe2767c5198d4fd6618a8134ed83507782b0265b27820dc8b1b58beab8d - SHA-1:
dec4cc2467f533ca0c757f45c0254e59c32e2eb2 - MD5:
0e31bc2775e04d1fc53244275d1ec5c7 - ssdeep:
768:rgGzpDLpoOQ+qKxDzA092GKdiWzmKV8iCmlSNUOPc69k+N0Fgw0F38aPlid3fLlC:UGF3pYV8wlSNUOPb9EIHPgd3RFepFx - TLSH:
T110338DF36067EC4D7BCF6B036DAB01A9644AD74C6136EB905988772CC47CAED6E00A50 - Submitted as: normal_5f8c3dead6294.pdf
- File type: pdf · Size: 47945 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.me/123?keyword=phonak+compilot+air+ii+instructions, https://cdn.shopify.com/s/files/1/0496/7297/8595/files/subway_surf_download_mac.pdf, https://cdn.shopify.com/s/files/1/0432/1378/3199/files/if_teresas_daughter_answer_yahoo.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.me/123?keyword=phonak+compilot+air+ii+instructions
- https://cdn.shopify.com/s/files/1/0496/7297/8595/files/subway_surf_download_mac.pdf
- https://cdn.shopify.com/s/files/1/0432/1378/3199/files/if_teresas_daughter_answer_yahoo.pdf
- https://cdn.shopify.com/s/files/1/0431/2665/3090/files/electricity_and_thermodynamics_review_worksheet_answers.pdf
- https://cdn-cms.f-static.net/uploads/4369332/normal_5f889d12ec609.pdf
- https://cdn-cms.f-static.net/uploads/4372371/normal_5f897265098e5.pdf
- https://cdn-cms.f-static.net/uploads/4368777/normal_5f885400ba6ac.pdf
- https://cdn-cms.f-static.net/uploads/4366048/normal_5f8b5b683f3d8.pdf
- https://cdn-cms.f-static.net/uploads/4367273/normal_5f8b652f172a0.pdf
- https://cdn-cms.f-static.net/uploads/4365539/normal_5f8718e221559.pdf
- https://cdn-cms.f-static.net/uploads/4366341/normal_5f8b6b84220f1.pdf
- https://cdn-cms.f-static.net/uploads/4365642/normal_5f8742011d501.pdf
- https://cdn-cms.f-static.net/uploads/4367311/normal_5f876756858a9.pdf
- https://cdn-cms.f-static.net/uploads/4369783/normal_5f894ff9230c2.pdf
- https://cdn-cms.f-static.net/uploads/4369796/normal_5f883fb58bb06.pdf
- https://cdn-cms.f-static.net/uploads/4366022/normal_5f8741593984b.pdf
- https://cdn-cms.f-static.net/uploads/4366321/normal_5f870dda749dd.pdf
- https://cdn-cms.f-static.net/uploads/4370533/normal_5f886357482c6.pdf
- https://cdn-cms.f-static.net/uploads/4366340/normal_5f875fc2aae8b.pdf
- https://cdn-cms.f-static.net/uploads/4376099/normal_5f8a6773323f1.pdf
- https://cdn.shopify.com/s/files/1/0431/3487/7850/files/puwosatabukixuxirufixe.pdf
- https://cdn.shopify.com/s/files/1/0438/9067/1771/files/old_english_game_bantam_club_of_america.pdf
- https://cdn.shopify.com/s/files/1/0427/4978/8327/files/rip_van_winkle_study_guide.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- ttraff.me
- cdn.shopify.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report