SUSPICIOUS — normal_5f8a8792678ac.pdf
SUSPICIOUS — normal_5f8a8792678ac.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
cf2853099bf540a677074643b41d6fb4bfce331e8c19dae5635517202ff57425 - SHA-1:
8efef2c8431047a235a4977b2117c8e1bf063b35 - MD5:
276abbe024a6b76d298fdb5df368bcce - ssdeep:
768:AgGzpDcpFX+Fu4NAN7NLNN+PJQtzcPdeIsGQaNfqTj/ZRb1CrG3aRAbeo+:NGFIpwdeI/QaNfQj/ZRb1OG3lbeo+ - TLSH:
T1FF33CFF3505BDD4C3AC79B035EA714A675CEC748B1369BA0458DA72CC8BC2BCAE10961 - Submitted as: normal_5f8a8792678ac.pdf
- File type: pdf · Size: 51727 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.com/123?keyword=gujarat+news+paper+pdf, https://cdn-cms.f-static.net/uploads/4374984/normal_5f891632e1401.pdf, https://cdn-cms.f-static.net/uploads/4366401/normal_5f8a0531c6951.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.com/123?keyword=gujarat+news+paper+pdf
- https://cdn-cms.f-static.net/uploads/4374984/normal_5f891632e1401.pdf
- https://cdn-cms.f-static.net/uploads/4366401/normal_5f8a0531c6951.pdf
- https://cdn-cms.f-static.net/uploads/4375207/normal_5f8a2f7cd4ce3.pdf
- https://cdn-cms.f-static.net/uploads/4370071/normal_5f89e972085fe.pdf
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/gapovowumepekegosiza.pdf
- https://vedabigejiko.weebly.com/uploads/1/3/1/4/131438046/jexiledekomira-sexivab-fosewafuvusazet-turasenezesaxa.pdf
- https://xuvakaxatal.weebly.com/uploads/1/3/1/0/131070170/103702.pdf
- https://jarapitoxedomel.weebly.com/uploads/1/3/1/4/131437170/zutotekimip_medun_furetu.pdf
- https://kidunaxu.weebly.com/uploads/1/3/1/4/131437100/7422174.pdf
- https://wekubuzebebam.weebly.com/uploads/1/3/0/7/130739705/7232879.pdf
- https://wozuwonasanava.weebly.com/uploads/1/3/1/4/131483955/nafikekopajime.pdf
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/mofep.pdf
- https://saxexowiki.weebly.com/uploads/1/3/0/9/130969873/fowanazokuxig-gekevad-zenolumadi-bakelozoj.pdf
- https://cdn-cms.f-static.net/uploads/4369333/normal_5f87c0f276fa0.pdf
- https://cdn-cms.f-static.net/uploads/4369936/normal_5f8852835e992.pdf
- https://cdn-cms.f-static.net/uploads/4365624/normal_5f88546306d3c.pdf
- https://cdn-cms.f-static.net/uploads/4374362/normal_5f8941cedfaec.pdf
- https://cdn-cms.f-static.net/uploads/4366022/normal_5f88be1cb0f58.pdf
- https://cdn.shopify.com/s/files/1/0493/3140/4959/files/fopazovevudaf.pdf
- https://cdn.shopify.com/s/files/1/0479/1654/8262/files/human_body_outline_worksheet.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ttraff.com
- cdn-cms.f-static.net
- genigudepa.weebly.com
- vedabigejiko.weebly.com
- xuvakaxatal.weebly.com
- jarapitoxedomel.weebly.com
- kidunaxu.weebly.com
- wekubuzebebam.weebly.com
- wozuwonasanava.weebly.com
- guwomenod.weebly.com
- saxexowiki.weebly.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report