SUSPICIOUS — normal_5f92057abc74f.pdf
SUSPICIOUS — normal_5f92057abc74f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
c76c3cb62209dbd07659f5a967c9a93d79aa7fdb54a53c6540ff89c4e3bb6426 - SHA-1:
9f1c891ab9684c971e4df50e5f287d5a8ab9e859 - MD5:
35994f5885171ab7d032167481a1c643 - ssdeep:
768:eMgGzpDxpjfHuUsegelPr0ZDFG1P2/qFRwy1x9UaugY/OVrDbi4yrCFy9VrkudUA:2GFdpHPM2rnuDAW4yzVoaQi20 - TLSH:
T15E33AFF35093EDCC3ECE1B139AA6154E6186D3496036D6A00CD9766CC4BCAFD6E10A22 - Submitted as: normal_5f92057abc74f.pdf
- File type: pdf · Size: 48878 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.link/123?keyword=addition+and+subtraction+worksheets+for+first+graders, https://uploads.strikinglycdn.com/files/4e7e5ffa-d2a2-46d8-b005-6371664edae6/77451127051.pdf, https://uploads.strikinglycdn.com/files/42ca3d7f-ee58-4898-9dd6-e46491fd1622/86796198958.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.link/123?keyword=addition+and+subtraction+worksheets+for+first+graders
- https://uploads.strikinglycdn.com/files/4e7e5ffa-d2a2-46d8-b005-6371664edae6/77451127051.pdf
- https://uploads.strikinglycdn.com/files/42ca3d7f-ee58-4898-9dd6-e46491fd1622/86796198958.pdf
- https://uploads.strikinglycdn.com/files/15cc8028-8e0a-427d-adf7-2061142b074a/31239914414.pdf
- https://uploads.strikinglycdn.com/files/ce47e4f1-3959-43d7-8aad-cf5d589cd595/ver_dr_house_online.pdf
- https://s3.amazonaws.com/xanebavifamopez/pdf_a_dwg_di_cadsofttools.pdf
- https://tegugozitofo.weebly.com/uploads/1/3/0/8/130874592/4f943b7888fd714.pdf
- https://medizagokitoni.weebly.com/uploads/1/3/2/3/132303310/454202.pdf
- https://xifobosakup.weebly.com/uploads/1/3/2/8/132815359/b2fe72900ba.pdf
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/tugunari_fogeze_nezejavoz.pdf
- https://fusesekomufe.weebly.com/uploads/1/3/1/6/131606177/rebijifafiridabot.pdf
- https://cdn.shopify.com/s/files/1/0496/3916/2005/files/wow_classic_resto_shaman_macros.pdf
- https://cdn.shopify.com/s/files/1/0499/9931/5104/files/bigepazexokazasipegopex.pdf
- https://cdn.shopify.com/s/files/1/0488/9375/5590/files/nipanuwakagenufa.pdf
- https://zifidobu.weebly.com/uploads/1/3/4/3/134371145/17e857f7.pdf
- https://narogigadi.weebly.com/uploads/1/3/0/8/130874066/76a7187bba.pdf
- https://zusaneji.weebly.com/uploads/1/3/0/8/130813769/6393733.pdf
- https://puvovajol.weebly.com/uploads/1/3/4/0/134040332/91bfab4.pdf
- https://kejedavozeve.weebly.com/uploads/1/3/1/4/131483662/gebixapitujozekida.pdf
- https://tugajepefur.weebly.com/uploads/1/3/1/4/131453805/dc40370d2f.pdf
- https://vunixumo.weebly.com/uploads/1/3/1/4/131453253/vusoligifolad.pdf
- https://jurizimobijagi.weebly.com/uploads/1/3/0/8/130874317/a2041a2.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ttraff.link
- uploads.strikinglycdn.com
- s3.amazonaws.com
- tegugozitofo.weebly.com
- medizagokitoni.weebly.com
- xifobosakup.weebly.com
- guwomenod.weebly.com
- fusesekomufe.weebly.com
- cdn.shopify.com
- zifidobu.weebly.com
- narogigadi.weebly.com
- zusaneji.weebly.com
- puvovajol.weebly.com
- kejedavozeve.weebly.com
- tugajepefur.weebly.com
- vunixumo.weebly.com
- jurizimobijagi.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report