SUSPICIOUS — normal_5f884772e961a.pdf
SUSPICIOUS — normal_5f884772e961a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
d2940c7faa1dba2eeee14b3ea814a6cc0bdeccdf56c781b48b867784a44b9b37 - SHA-1:
af5f06dc2d99ed7ea970ec7da747d0b10928479c - MD5:
7b7fa21cf6ef463c0409ebfb7d64914d - ssdeep:
768:VgGzpDCpvHsTZ/h96u8jf8VNlUjzWu+CSuszEF2xMVzx4lQTOYhQn6/Qblqc:GGF2pvx8uszEnVS66YL/0lqc - TLSH:
T184328EF39497DD4D7A8BAB53ADBB11656089D34C6133EB80448C772CD4BCAAD7E50820 - Submitted as: normal_5f884772e961a.pdf
- File type: pdf · Size: 46390 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=tv+guide+brisbane+freeview, https://cdn-cms.f-static.net/uploads/4367631/normal_5f88373665e6a.pdf, https://cdn-cms.f-static.net/uploads/4365612/normal_5f870ecddd1e7.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=tv+guide+brisbane+freeview
- https://cdn-cms.f-static.net/uploads/4367631/normal_5f88373665e6a.pdf
- https://cdn-cms.f-static.net/uploads/4365612/normal_5f870ecddd1e7.pdf
- https://cdn-cms.f-static.net/uploads/4365563/normal_5f8722bd586b4.pdf
- https://cdn-cms.f-static.net/uploads/4368979/normal_5f87f45a7a025.pdf
- https://cdn-cms.f-static.net/uploads/4365591/normal_5f86f8820800e.pdf
- https://site-1037102.mozfiles.com/files/1037102/pegutewi.pdf
- https://site-1042883.mozfiles.com/files/1042883/vovamaseleriluvopuxajav.pdf
- https://site-1043770.mozfiles.com/files/1043770/21791417179.pdf
- https://site-1044191.mozfiles.com/files/1044191/mycobacterium_tuberculosis_life_cycle.pdf
- https://site-1042666.mozfiles.com/files/1042666/92949587531.pdf
- https://cdn-cms.f-static.net/uploads/4369305/normal_5f8821e7edbe1.pdf
- https://cdn-cms.f-static.net/uploads/4366033/normal_5f878535a53b7.pdf
- https://cdn-cms.f-static.net/uploads/4366048/normal_5f86f8ab6d5f8.pdf
- https://cdn-cms.f-static.net/uploads/4366024/normal_5f8703f0eefc7.pdf
- https://cdn-cms.f-static.net/uploads/4368748/normal_5f87efec243c8.pdf
- https://cdn.shopify.com/s/files/1/0486/2682/7432/files/instaflex_joint_support_side_effects.pdf
- https://cdn.shopify.com/s/files/1/0491/8168/7974/files/48301386860.pdf
- https://cdn.shopify.com/s/files/1/0432/3583/6068/files/voperatozodikit.pdf
- https://cdn.shopify.com/s/files/1/0480/8956/3299/files/spotify_keeps_pausing_2020.pdf
- https://cdn-cms.f-static.net/uploads/4365560/normal_5f87a13e9b1cf.pdf
- https://cdn-cms.f-static.net/uploads/4368248/normal_5f878d07d9a65.pdf
- https://cdn-cms.f-static.net/uploads/4367277/normal_5f8763a0a255d.pdf
- https://cdn-cms.f-static.net/uploads/4367294/normal_5f8787bca528a.pdf
- https://cdn-cms.f-static.net/uploads/4365649/normal_5f8727ac96fa9.pdf
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- site-1037102.mozfiles.com
- site-1042883.mozfiles.com
- site-1043770.mozfiles.com
- site-1044191.mozfiles.com
- site-1042666.mozfiles.com
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report