SUSPICIOUS — normal_5f8b5a17333ee.pdf
SUSPICIOUS — normal_5f8b5a17333ee.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
e27663b304c469bf8681672ef5be589c51ef9a41fbc3c59532610d79acb97ce3 - SHA-1:
0350d8884bea62b556106dd28370a68f924584d6 - MD5:
ef6232eade73e2497c67bb44b0bce007 - ssdeep:
1536:tGFMpSQAOLOkwHG+PH1PbmrpkqZm1S1DeZ9Z:wFMpSZ/PHS9ZugDeB - TLSH:
T14E349DF790E3EE4D3A878B03AD6B15B56488D38D7236A790548C663DC4BC67DAF10860 - Submitted as: normal_5f8b5a17333ee.pdf
- File type: pdf · Size: 54618 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.ru/123?keyword=esade+casebook+pdf+download, https://cdn-cms.f-static.net/uploads/4365642/normal_5f8730752c5f6.pdf, https://cdn-cms.f-static.net/uploads/4378607/normal_5f8a182675a09.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.ru/123?keyword=esade+casebook+pdf+download
- https://cdn-cms.f-static.net/uploads/4365642/normal_5f8730752c5f6.pdf
- https://cdn-cms.f-static.net/uploads/4378607/normal_5f8a182675a09.pdf
- https://cdn-cms.f-static.net/uploads/4367622/normal_5f89e58878fbf.pdf
- https://cdn-cms.f-static.net/uploads/4377120/normal_5f8ac93b5a759.pdf
- https://cdn-cms.f-static.net/uploads/4366622/normal_5f877e385f577.pdf
- https://cdn.shopify.com/s/files/1/0496/2412/1495/files/51296684350.pdf
- https://cdn.shopify.com/s/files/1/0268/7316/8049/files/head_first_software_development_review.pdf
- https://cdn.shopify.com/s/files/1/0499/2850/3464/files/manuale_lavastoviglie_electrolux_esf5535lox.pdf
- https://cdn.shopify.com/s/files/1/0495/9902/1220/files/lexington_high_school_science_bowl.pdf
- https://cdn.shopify.com/s/files/1/0436/9465/3595/files/van_buren_elementary_janesville_wi.pdf
- https://kivuligob.weebly.com/uploads/1/3/0/8/130874143/8777662.pdf
- https://gonerogad.weebly.com/uploads/1/3/1/4/131438616/2404337.pdf
- https://boguvetasitob.weebly.com/uploads/1/3/1/3/131380850/7146550.pdf
- https://wefejakero.weebly.com/uploads/1/3/0/8/130814310/zununat_pizagaxikovez_gofewikavawiza_fusesawemiwu.pdf
- https://cdn-cms.f-static.net/uploads/4365657/normal_5f888ca9adfb7.pdf
- https://cdn-cms.f-static.net/uploads/4375206/normal_5f89de263d007.pdf
- https://cdn-cms.f-static.net/uploads/4374847/normal_5f8aab317d489.pdf
- https://cdn-cms.f-static.net/uploads/4366302/normal_5f87364a4b4f0.pdf
- https://cdn-cms.f-static.net/uploads/4373248/normal_5f896f77bf448.pdf
- https://cdn-cms.f-static.net/uploads/4366028/normal_5f87e677710e6.pdf
- https://cdn-cms.f-static.net/uploads/4367004/normal_5f874dad8466f.pdf
- https://cdn-cms.f-static.net/uploads/4366395/normal_5f875719bd5f3.pdf
- https://cdn-cms.f-static.net/uploads/4368777/normal_5f88998657dc3.pdf
- https://cdn-cms.f-static.net/uploads/4376879/normal_5f8a4a3f4ca2f.pdf
Embedded domains
- ttraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- kivuligob.weebly.com
- gonerogad.weebly.com
- boguvetasitob.weebly.com
- wefejakero.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report