SUSPICIOUS — normal_5f978cd1f1f21.pdf
SUSPICIOUS — normal_5f978cd1f1f21.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
e2e1485cbd78c5ed70b51d0063533c75f71864e41c8b512bc37e1433b65ca437 - SHA-1:
2fdf1cb61b309a165b26cfe111ab643b482304af - MD5:
ab68c96e7208ba86a2d69203fdbd7386 - ssdeep:
1536:QGFUppTvMbbGfycv0BabRsuHLxKA/dTwAW:dFUppTv+GfFoZuHVKWtq - TLSH:
T10F35AFF35077EC4C3B8B9B1369E715299089EB4CA1229AA1448C773DC1BC6BD6F00A61 - Submitted as: normal_5f978cd1f1f21.pdf
- File type: pdf · Size: 61878 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.com/123?keyword=mavic+pro+user+guide, https://cdn.shopify.com/s/files/1/0468/8320/9373/files/wosimenapabozutadetupesis.pdf, https://cdn.shopify.com/s/files/1/0496/8618/4095/files/1324934241.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.com/123?keyword=mavic+pro+user+guide
- https://cdn.shopify.com/s/files/1/0468/8320/9373/files/wosimenapabozutadetupesis.pdf
- https://cdn.shopify.com/s/files/1/0496/8618/4095/files/1324934241.pdf
- https://cdn.shopify.com/s/files/1/0499/3777/6798/files/data_analytics_for_non-life_insurance_pricing.pdf
- https://cdn.shopify.com/s/files/1/0503/2493/0728/files/79800843032.pdf
- https://cdn.shopify.com/s/files/1/0492/2844/7900/files/17918136913.pdf
- https://cdn.shopify.com/s/files/1/0502/3573/6239/files/7232042508.pdf
- https://cdn.shopify.com/s/files/1/0498/6149/2893/files/34854702842.pdf
- https://cdn-cms.f-static.net/uploads/4366961/normal_5f938f0f99780.pdf
- https://cdn-cms.f-static.net/uploads/4376858/normal_5f89bcc2b6556.pdf
- https://cdn-cms.f-static.net/uploads/4379034/normal_5f8d3814d66dd.pdf
- https://cdn-cms.f-static.net/uploads/4377933/normal_5f952e7d29e5c.pdf
- https://cdn-cms.f-static.net/uploads/4366989/normal_5f89d9c66eb29.pdf
- https://cdn-cms.f-static.net/uploads/4403565/normal_5f962b8128965.pdf
- https://cdn-cms.f-static.net/uploads/4376098/normal_5f8c5e5c5e891.pdf
- https://cdn-cms.f-static.net/uploads/4369165/normal_5f8d6425b49a9.pdf
- https://cdn-cms.f-static.net/uploads/4379032/normal_5f8b9326d6ef0.pdf
- https://cdn-cms.f-static.net/uploads/4366043/normal_5f87a2471c9d0.pdf
- https://s3.amazonaws.com/mozirolinitaje/gesusigoxaziwesuwaxigo.pdf
- https://s3.amazonaws.com/sugaguxagu/web_design_proposal.pdf
- https://s3.amazonaws.com/leguvefu/windsor_knot_instructions.pdf
- https://s3.amazonaws.com/vunizi/active_membrane_potential.pdf
- https://s3.amazonaws.com/pivetuzadujo/gst_book_download_in_hindi.pdf
- https://cdn-cms.f-static.net/uploads/4375890/normal_5f97777bc04a4.pdf
- https://cdn-cms.f-static.net/uploads/4382960/normal_5f91c9aa610ef.pdf
Embedded domains
- ttraff.com
- cdn.shopify.com
- cdn-cms.f-static.net
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report