SUSPICIOUS — normal_5f88c0a99bbb9.pdf
SUSPICIOUS — normal_5f88c0a99bbb9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
e739e4e30cfad5a05b45c4fe6e8631ef449d48e0cf1a1a994361ba0e12c70910 - SHA-1:
6f746ebc7860e3b5389a448ad9d08472a92a110f - MD5:
47e625e5fe7d389812dcb754b1cd3828 - ssdeep:
768:RgGzpDepUz4SucAaOmHJYY61xqy6S+4wySzwPdro8231V8eyG:iGF6pU/ZJeOS+4kzwPdstV8eyG - TLSH:
T17C328DF30097ED4CBA8AAB079DEB00A95189D34CA23BD7505898777CD8BC1BD7E10561 - Submitted as: normal_5f88c0a99bbb9.pdf
- File type: pdf · Size: 44790 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://cctraff.ru/123?keyword=oxford+emergency+medicine+pdf+download, https://site-1039257.mozfiles.com/files/1039257/63106990737.pdf, https://site-1043032.mozfiles.com/files/1043032/rubejatezebezeva.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://cctraff.ru/123?keyword=oxford+emergency+medicine+pdf+download
- https://site-1039257.mozfiles.com/files/1039257/63106990737.pdf
- https://site-1043032.mozfiles.com/files/1043032/rubejatezebezeva.pdf
- https://site-1040567.mozfiles.com/files/1040567/17887375239.pdf
- https://site-1040597.mozfiles.com/files/1040597/49963293103.pdf
- https://site-1039646.mozfiles.com/files/1039646/ropog.pdf
- https://ranerenonosojib.weebly.com/uploads/1/3/1/4/131483420/4447094.pdf
- https://tejojobowadame.weebly.com/uploads/1/3/0/8/130874570/kozuruguzerowimav.pdf
- https://fevixivosetakub.weebly.com/uploads/1/3/2/6/132681861/9537109.pdf
- https://vixijusodu.weebly.com/uploads/1/3/0/7/130776714/24abb2ed4a40.pdf
- https://ranerenonosojib.weebly.com/uploads/1/3/1/4/131483420/xiwul.pdf
- https://pepisukuwen.weebly.com/uploads/1/3/1/6/131606293/melasirazoxijirag.pdf
- https://fobewesepujub.weebly.com/uploads/1/3/2/3/132303403/xisub.pdf
- https://fizolapojola.weebly.com/uploads/1/3/1/3/131383549/9304137.pdf
- https://site-1039600.mozfiles.com/files/1039600/9629830741.pdf
- https://site-1038669.mozfiles.com/files/1038669/67616285498.pdf
- https://site-1040521.mozfiles.com/files/1040521/10267588014.pdf
- https://site-1043538.mozfiles.com/files/1043538/77054816753.pdf
- https://site-1036829.mozfiles.com/files/1036829/30031675670.pdf
- https://site-1042345.mozfiles.com/files/1042345/labujasusij.pdf
- https://cdn-cms.f-static.net/uploads/4370064/normal_5f88bb1d44b65.pdf
- https://cdn-cms.f-static.net/uploads/4370267/normal_5f88bc7a24cf5.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- cctraff.ru
- site-1039257.mozfiles.com
- site-1043032.mozfiles.com
- site-1040567.mozfiles.com
- site-1040597.mozfiles.com
- site-1039646.mozfiles.com
- ranerenonosojib.weebly.com
- tejojobowadame.weebly.com
- fevixivosetakub.weebly.com
- vixijusodu.weebly.com
- pepisukuwen.weebly.com
- fobewesepujub.weebly.com
- fizolapojola.weebly.com
- site-1039600.mozfiles.com
- site-1038669.mozfiles.com
- site-1040521.mozfiles.com
- site-1043538.mozfiles.com
- site-1036829.mozfiles.com
- site-1042345.mozfiles.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report