SUSPICIOUS — normal_5f8a55875fe35.pdf

SUSPICIOUS — normal_5f8a55875fe35.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: cf4e091fc84df4889348769942a684e4c6e213f6e57ea713ae15a0082337c197
• SHA-1: 795b667dc52236381f1730488d49578659882453
• MD5: ca37854f069b8504ed1767d71fbaf0fd
• ssdeep: 768:zgGzpDCp+EBjL58FbmSeYfN8eDln7vQmUbD/KU1yPQqaetvJchSbKl9LFD4l4QTb:MGFWp+UBbGR4ethcvl9LFNQTVpsHZDST
• TLSH: T10132AFF35097DC8D7A8E6B03AEBF1059268AC78D6132D66015C8372CD47CAFD6E04A61
• Submitted as: normal_5f8a55875fe35.pdf
• File type: pdf · Size: 44503 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://cctraff.ru/123?keyword=seasons+worksheet+6th+grade, https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/bamudepekepa_setumazowido.pdf, https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/7085545.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/123?keyword=seasons+worksheet+6th+grade
• https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/bamudepekepa_setumazowido.pdf
• https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/7085545.pdf
• https://kelobutino.weebly.com/uploads/1/3/0/9/130969458/d5d92ec740.pdf
• https://cdn.shopify.com/s/files/1/0499/1480/6440/files/iphone_6_repair_manual.pdf
• https://cdn.shopify.com/s/files/1/0501/4952/3621/files/kofomituwes.pdf
• https://cdn.shopify.com/s/files/1/0438/3349/1606/files/19805843366.pdf
• https://cdn.shopify.com/s/files/1/0434/6282/0005/files/21475122461.pdf
• https://cdn.shopify.com/s/files/1/0266/9091/2442/files/corner_storage_bench.pdf
• https://uploads.strikinglycdn.com/files/a04d49ba-b2fe-4d32-8885-28cc99759775/luritedofufixofabamek.pdf
• https://uploads.strikinglycdn.com/files/355ba9e7-b117-4dd2-a9e5-f000786dd14e/sixujobulejusami.pdf
• https://uploads.strikinglycdn.com/files/45f9413d-ce56-4870-82aa-53a8c29e5e03/wowijeki.pdf
• https://cdn.shopify.com/s/files/1/0486/0470/9029/files/spotify_downloader_apk_crack.pdf
• https://cdn.shopify.com/s/files/1/0438/0046/1474/files/75606789906.pdf
• https://cdn.shopify.com/s/files/1/0495/9027/2152/files/ordenes_de_trabajo.pdf
• https://cdn.shopify.com/s/files/1/0431/8475/0747/files/articles_of_confederation_vs_constitution_worksheet.pdf
• https://cdn.shopify.com/s/files/1/0459/9270/6207/files/63103469386.pdf
• https://cdn.shopify.com/s/files/1/0496/2680/8484/files/63986381091.pdf
• https://cdn.shopify.com/s/files/1/0432/6627/7534/files/7781669452.pdf
• https://cdn.shopify.com/s/files/1/0437/3777/6289/files/oakwood_elementary_school_supply_list.pdf
• https://cdn.shopify.com/s/files/1/0499/0622/1214/files/ticwatch_pro_manuale_italiano.pdf
• https://cdn.shopify.com/s/files/1/0433/9440/0423/files/ib_math_studies_internal_assessment_sample.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/

Embedded domains

• cctraff.ru
• vuxozajuje.weebly.com
• jakedekokobara.weebly.com
• kelobutino.weebly.com
• cdn.shopify.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report