SUSPICIOUS — normal_5f876f790a8c9.pdf
SUSPICIOUS — normal_5f876f790a8c9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c869ad54ec0d4ad40a41e19e2d03336c521d99887bde53d852fce8b809569b01 - SHA-1:
922597e100bdcb6695909826838b6f97073d2b04 - MD5:
92a4c7cf9266fd3d673043fa2f614c17 - ssdeep:
768:kgGzpD5rp6ZScFwbE1S++HMMW91GtnHhDryjds2vtPMd+wNkyUlTf6+8F:RGFdrp6EHdryps2vxxyUFC+8F - TLSH:
T1DF338EF7149BDD4C7E87AB43AC7A2525548EC7896237E75040CC2B2D847CABE6F10864 - Submitted as: normal_5f876f790a8c9.pdf
- File type: pdf · Size: 49406 bytes
- Verdict: suspicious (58/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/c1bedac1-c4e2-481c-beb6-927aa0f12921/27889787409.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://cctraff.ru/123?keyword=economic+importance+of+algae+in+medicine+pdf, https://site-1043204.mozfiles.com/files/1043204/67798163364.pdf, https://site-1039143.mozfiles.com/files/1039143/widokozupovumedodo.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?keyword=economic+importance+of+algae+in+medicine+pdf
- https://site-1043204.mozfiles.com/files/1043204/67798163364.pdf
- https://site-1039143.mozfiles.com/files/1039143/widokozupovumedodo.pdf
- https://site-1040663.mozfiles.com/files/1040663/munavazukidixaki.pdf
- https://cdn-cms.f-static.net/uploads/4365635/normal_5f876c4415ff2.pdf
- https://cdn-cms.f-static.net/uploads/4367644/normal_5f8751a28d91f.pdf
- https://cdn-cms.f-static.net/uploads/4365657/normal_5f875c3955277.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f8767cfebe47.pdf
- https://uploads.strikinglycdn.com/files/c1bedac1-c4e2-481c-beb6-927aa0f12921/27889787409.pdf
- https://uploads.strikinglycdn.com/files/3a0a55f9-e77f-484b-bda5-0c1887f85162/vijaronif.pdf
- https://uploads.strikinglycdn.com/files/5def2234-7520-46e9-9eee-5d4342279915/97060105761.pdf
- https://uploads.strikinglycdn.com/files/b839f753-d936-4447-b80c-92a7c67913fb/vasivewokefiwid.pdf
- https://uploads.strikinglycdn.com/files/b9bd6c00-2933-4af2-8867-ce7a7be77a92/80435333006.pdf
- https://cdn-cms.f-static.net/uploads/4366989/normal_5f876acedd1d7.pdf
- https://cdn-cms.f-static.net/uploads/4368226/normal_5f876d4128f93.pdf
- https://cdn-cms.f-static.net/uploads/4366321/normal_5f876cbfe75ec.pdf
- https://cdn-cms.f-static.net/uploads/4366033/normal_5f87430abad52.pdf
- https://cdn-cms.f-static.net/uploads/4366993/normal_5f876ecb4623d.pdf
- https://uploads.strikinglycdn.com/files/35f2e6af-a87b-4aaf-bc19-9fd4ee6041af/vafipiketafulododovu.pdf
- https://uploads.strikinglycdn.com/files/75065a39-4ffd-45e9-9c9d-82cc10e5da80/givebitop.pdf
- https://uploads.strikinglycdn.com/files/daef1b59-6ceb-419d-90c4-242086844a69/sepakixunifek.pdf
- https://uploads.strikinglycdn.com/files/3492dbc6-1bbb-4005-9f7c-2bc7b0f50af7/temawuvi.pdf
- https://cdn-cms.f-static.net/uploads/4366661/normal_5f871c0e8fd8f.pdf
- https://cdn-cms.f-static.net/uploads/4365642/normal_5f875bd2b88fe.pdf
- https://cdn-cms.f-static.net/uploads/4368251/normal_5f876ec0eeef3.pdf
Embedded domains
- cctraff.ru
- site-1043204.mozfiles.com
- site-1039143.mozfiles.com
- site-1040663.mozfiles.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report