SUSPICIOUS — normal_5f8b1af226519.pdf
SUSPICIOUS — normal_5f8b1af226519.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
d541f1a53f30b8e4db0ade241b20e8b4d9102aa2764f0092946473060c984dc1 - SHA-1:
2fabbbaca4d08943b4951131d8292717df80ef8f - MD5:
f23b2ea21bcd862ab7ec5e4463834f31 - ssdeep:
768:mgGzpDseprO5q5HMAClZttSi6pKi8Slffvshu796yKfxusjqBp+CqsbSC49MHXl5:zGFYeMiXlf3wuJofxusS+SbW9M3lPpie - TLSH:
T129328CF364DBDC4C3A879B53AC77016AA54EC7886132E790458C772CC47C6BD6E60990 - Submitted as: normal_5f8b1af226519.pdf
- File type: pdf · Size: 47493 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=parts+of+speech+test+grade+6+pdf, https://cdn-cms.f-static.net/uploads/4367622/normal_5f87526ad48d3.pdf, https://cdn-cms.f-static.net/uploads/4366022/normal_5f87015468390.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=parts+of+speech+test+grade+6+pdf
- https://cdn-cms.f-static.net/uploads/4367622/normal_5f87526ad48d3.pdf
- https://cdn-cms.f-static.net/uploads/4366022/normal_5f87015468390.pdf
- https://cdn-cms.f-static.net/uploads/4368492/normal_5f8a79f18d865.pdf
- https://cdn.shopify.com/s/files/1/0430/8638/1210/files/watozijesana.pdf
- https://cdn.shopify.com/s/files/1/0484/1871/7864/files/22059457701.pdf
- https://cdn-cms.f-static.net/uploads/4374980/normal_5f89265b06a24.pdf
- https://cdn-cms.f-static.net/uploads/4365607/normal_5f870c082402c.pdf
- https://cdn-cms.f-static.net/uploads/4365626/normal_5f87522b38550.pdf
- https://cdn-cms.f-static.net/uploads/4365638/normal_5f8705b904376.pdf
- https://cdn-cms.f-static.net/uploads/4367300/normal_5f87be85c54f8.pdf
- https://cdn-cms.f-static.net/uploads/4377120/normal_5f8a2b4272bbf.pdf
- https://cdn-cms.f-static.net/uploads/4365619/normal_5f87c5a87ef70.pdf
- https://cdn-cms.f-static.net/uploads/4374839/normal_5f8acc1e44521.pdf
- https://cdn-cms.f-static.net/uploads/4365541/normal_5f872e7505803.pdf
- https://cdn-cms.f-static.net/uploads/4365598/normal_5f8a890a4831b.pdf
- https://uploads.strikinglycdn.com/files/05bb2438-5f71-4bde-87d6-148672da48a5/the_old_man_and_the_sea_study_guide_questions_and_answers.pdf
- https://uploads.strikinglycdn.com/files/722666e0-3a27-4280-9755-5004acf734d0/6547051565.pdf
- https://uploads.strikinglycdn.com/files/53259845-1f8b-49fa-b42e-85fd8a71271d/dasirujomusosepudoli.pdf
- https://uploads.strikinglycdn.com/files/5d2d285d-ad90-427f-8df6-0049bc097562/famefojuvopu.pdf
- https://uploads.strikinglycdn.com/files/d538985f-4f61-47fb-b3a9-1d08f7be0c35/xutizotegavaz.pdf
- https://uploads.strikinglycdn.com/files/86d07471-3f05-4bc0-adaa-08400cdfb527/moler.pdf
- https://uploads.strikinglycdn.com/files/adf8d671-f8b8-4400-861d-063aec8e45bd/74285665412.pdf
- https://uploads.strikinglycdn.com/files/4078dca0-a93b-4425-bdb6-37a744f3ba94/10996195849.pdf
- https://uploads.strikinglycdn.com/files/f852c871-a607-4129-992b-4aeba7da7afe/77832007434.pdf
Embedded domains
- ggtraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report