SUSPICIOUS — normal_5f9228c9e1b80.pdf

SUSPICIOUS — normal_5f9228c9e1b80.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ddeb78ef98058453f1ed5e4bfe92c9d22d0a923308c7758a7cf8593e49fd2ea6
• SHA-1: 3b223c00e3fc3743caa4325fcc8859b8e6c696f6
• MD5: f35dfb29ec6914d6a0898b1682d05dfa
• ssdeep: 768:ogGzpDqpIR6P/LeX5Ws5TpgQ2Iu8myvRe4MNPtf7EQyUcqJgnaIFuSwp6dtXU:lGFupTTeX57NgrISPQQyqga7SZdtXU
• TLSH: T15333BEF3809BCD8D7AC79F43AED914186189D2996033E76049CD3B6CD4BC6ED2E10962
• Submitted as: normal_5f9228c9e1b80.pdf
• File type: pdf · Size: 50005 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ttraff.club/123?keyword=new+larousse+gastronomique+pdf, https://cdn.shopify.com/s/files/1/0499/2381/7640/files/dalopokabosuwalusulera.pdf, https://cdn.shopify.com/s/files/1/0268/8034/4258/files/36459774888.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/123?keyword=new+larousse+gastronomique+pdf
• https://s3.amazonaws.com/xanebavifamopez/69577487602.pdf
• https://s3.amazonaws.com/gotenukevepunin/knurling_operation_on_lathe_machine.pdf
• https://s3.amazonaws.com/gajabedafot/forex_technical_analysis_indicators.pdf
• https://s3.amazonaws.com/zirojopemup/follicular_atresia.pdf
• https://cdn.shopify.com/s/files/1/0499/2381/7640/files/dalopokabosuwalusulera.pdf
• https://cdn.shopify.com/s/files/1/0496/1930/4599/files/free_growth_mindset_activities_for_adults.pdf
• https://cdn.shopify.com/s/files/1/0268/8034/4258/files/36459774888.pdf
• https://cdn.shopify.com/s/files/1/0479/3591/4140/files/rerumenijetekavedokugutuj.pdf
• https://winomumamo.weebly.com/uploads/1/3/1/0/131070375/0933f.pdf
• https://sirawomaperuli.weebly.com/uploads/1/3/1/3/131398091/dasumave.pdf
• https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/ff51353ffd7b.pdf
• https://jiwepurojal.weebly.com/uploads/1/3/0/7/130775762/988fa418.pdf
• https://cdn.shopify.com/s/files/1/0498/4989/3026/files/bmw_335i_owners_manual_2015.pdf
• https://cdn.shopify.com/s/files/1/0431/3759/7591/files/die_in_hell_german.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• s3.amazonaws.com
• cdn.shopify.com
• winomumamo.weebly.com
• sirawomaperuli.weebly.com
• dimaxafazeza.weebly.com
• jiwepurojal.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report