MALICIOUS — normal_5f8cc4e625cb9.pdf
MALICIOUS — normal_5f8cc4e625cb9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (75/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
d1d1696db1c692f204eb115ac1f9f669b4eebef80152420efacee2e491335a5f - SHA-1:
f4d71ab21b344f877128a096b0130e8cb3c5e176 - MD5:
1159a2f42b00392263d8008cdc71abf6 - ssdeep:
768:fSgGzpDOpZPLybTZ/iFm/+EfegFURpaw6e96ULUXgdCwd9RGgVGOg:fPGFqprr2evLUwdCopVGOg - TLSH:
T191328DF3649BED8D7E869B43ADE61259214DC3882237E76049CC372CC07C6BD6E019A0 - Submitted as: normal_5f8cc4e625cb9.pdf
- File type: pdf · Size: 44447 bytes
- Verdict: malicious (75/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 75/100 is the fusion of 4 weighted signals:
- Embedded link rated malicious by URL analysis: https://cdn-cms.f-static.net/uploads/4366362/normal_5f88a7cc109e2.pdf - network signal, weight 0.70, confidence 0.80
- Embedded network infrastructure: https://ttraff.ru/123?keyword=dragon+quest+ix+boss+guide, https://cdn-cms.f-static.net/uploads/4375700/normal_5f8a1ca84327f.pdf, https://cdn-cms.f-static.net/uploads/4366374/normal_5f88b5c97b160.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.ru/123?keyword=dragon+quest+ix+boss+guide
- https://cdn-cms.f-static.net/uploads/4375700/normal_5f8a1ca84327f.pdf
- https://cdn-cms.f-static.net/uploads/4366374/normal_5f88b5c97b160.pdf
- https://cdn-cms.f-static.net/uploads/4383917/normal_5f8cb40c1e4d1.pdf
- https://cdn-cms.f-static.net/uploads/4374859/normal_5f8acc701cad1.pdf
- https://xebikazogede.weebly.com/uploads/1/3/2/7/132740990/zivuguzuduvixuz_burodutisim_kugadufeviniwaz_lukufediwakeku.pdf
- https://cdn.shopify.com/s/files/1/0483/2503/4148/files/3rd_grade_math_assessment_test_virginia.pdf
- https://cdn.shopify.com/s/files/1/0441/2892/7896/files/vehicle_document_alert_notice_scam.pdf
- https://cdn.shopify.com/s/files/1/0502/4441/9757/files/edukasyon_sa_pagpapakatao_grade_4_worksheets.pdf
- https://cdn.shopify.com/s/files/1/0472/3061/5717/files/peluwuregevijuvu.pdf
- https://cdn.shopify.com/s/files/1/0481/3884/6359/files/download_mindly_pro_apk.pdf
- https://cdn-cms.f-static.net/uploads/4366389/normal_5f87520ab22f1.pdf
- https://cdn-cms.f-static.net/uploads/4366362/normal_5f88a7cc109e2.pdf
- https://uploads.strikinglycdn.com/files/952016e2-be0b-44a2-bc63-93b1a6576be2/97893558770.pdf
- https://uploads.strikinglycdn.com/files/d963ea62-f4c0-41b6-8f6f-59e327003692/75883958572.pdf
- https://uploads.strikinglycdn.com/files/cf98d33f-1764-43d5-9677-967a7a5aa2f2/85054120354.pdf
- https://uploads.strikinglycdn.com/files/92a72013-a293-4614-a1c2-13abf4cf9a35/68486383690.pdf
- https://uploads.strikinglycdn.com/files/322ae7dd-e446-4f79-92e6-e75a840c07dd/78760153455.pdf
- https://uploads.strikinglycdn.com/files/4901c157-3b7a-4ecf-b357-d6753e8ffd71/1329943080.pdf
- https://uploads.strikinglycdn.com/files/dfccbd13-cb4a-48bd-b9b3-c206f8d41347/10697136618.pdf
- https://uploads.strikinglycdn.com/files/a2010145-aef4-4559-bdaf-a150edcffb48/84684943321.pdf
- https://uploads.strikinglycdn.com/files/1be94769-6090-4f01-ac8f-21c4aaf35116/selepavebexafaka.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- ttraff.ru
- cdn-cms.f-static.net
- xebikazogede.weebly.com
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report