SUSPICIOUS — normal_5f950ef062576.pdf
SUSPICIOUS — normal_5f950ef062576.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
dd969e4e11febac70714d592b0d60508816e0c4e967efae21fb464fa58f930c5 - SHA-1:
ca26502b45afb0d9c0658356960f2192f5915d73 - MD5:
2db3c9ec544627cf64b0ae5e57473864 - ssdeep:
1536:iGFeEKYrJfspZo8M0Brsu/EB2UcihTN5OydKGpaSR43QCSZK:bFeDNrj/EoUdTPmGwJ3d5 - TLSH:
T129369EF74567EC8C3AC7DB0339FA1869604ADB48222297A049CD76BCC5BC6BDBD00521 - Submitted as: normal_5f950ef062576.pdf
- File type: pdf · Size: 67930 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/6a08089e-9d52-4c7e-b434-7ab5bccf2497/monsieur_ibrahim_et_les_fleurs_du_co.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ggtraff.ru/123?keyword=meteorology+today+pdf+free, https://cdn.shopify.com/s/files/1/0433/7333/0593/files/thermosol_dyeing_process.pdf, https://cdn.shopify.com/s/files/1/0502/3930/7949/files/46634548836.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ggtraff.ru/123?keyword=meteorology+today+pdf+free
- https://cdn.shopify.com/s/files/1/0433/7333/0593/files/thermosol_dyeing_process.pdf
- https://cdn.shopify.com/s/files/1/0502/3930/7949/files/46634548836.pdf
- https://cdn.shopify.com/s/files/1/0497/7888/4759/files/satellite_communication_network.pdf
- https://cdn.shopify.com/s/files/1/0495/4941/0456/files/flying_m_ranch_california.pdf
- https://cdn.shopify.com/s/files/1/0502/2751/1496/files/super_mario_rpg_character_guide.pdf
- https://uploads.strikinglycdn.com/files/6a08089e-9d52-4c7e-b434-7ab5bccf2497/monsieur_ibrahim_et_les_fleurs_du_co.pdf
- https://uploads.strikinglycdn.com/files/ef66fffb-5da9-4a16-8248-9f5657df3bce/linkin_park_with_you_lyrics.pdf
- https://uploads.strikinglycdn.com/files/f607cc2a-c7b4-4365-958b-91293f525505/10950566890.pdf
- https://uploads.strikinglycdn.com/files/aea691be-1ff0-41d5-9aac-0e996a88932a/30585878168.pdf
- https://uploads.strikinglycdn.com/files/284dbcbf-2dd4-40a6-93d4-65aa79f2882b/mapifoxalujewesub.pdf
- https://uploads.strikinglycdn.com/files/15323e90-8d8b-4fc5-8c0f-c293f6e664f7/lagililasimo.pdf
- https://cdn-cms.f-static.net/uploads/4376600/normal_5f94c85f83ddb.pdf
- https://cdn-cms.f-static.net/uploads/4370768/normal_5f8b48df4ded9.pdf
- https://cdn-cms.f-static.net/uploads/4365602/normal_5f8c01d20359a.pdf
- https://uploads.strikinglycdn.com/files/a0238dfd-dbbf-4e6f-8ab8-2f083543b8fb/1013640686.pdf
- https://uploads.strikinglycdn.com/files/35f0640f-beca-4d29-aa3c-7cf69d795b40/mudra_de_la_armonia.pdf
- https://cdn.shopify.com/s/files/1/0500/9067/2293/files/wow_vanilla_thunderfury_guide.pdf
- https://cdn.shopify.com/s/files/1/0433/4298/7422/files/dhgate_nz_legit.pdf
- https://cdn.shopify.com/s/files/1/0496/4076/7639/files/rankin_county_school_district_lunch_menu.pdf
- https://cdn.shopify.com/s/files/1/0486/0156/3301/files/mekepajixowawavixepi.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ggtraff.ru
- cdn.shopify.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report