SUSPICIOUS — normal_5fc59b3193e9e.pdf

SUSPICIOUS — normal_5fc59b3193e9e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ea6a1fd10d59697d25753734b130dbe3c766ddb741b094441bc7276a7705bf0b
• SHA-1: 7baa26f1b8643eb368a690fe220bbe19917db968
• MD5: 25c18d502072d8795d3d23bf2f03e59f
• ssdeep: 1536:eRV/iqh1gPUYAsfQrprfJZvDq1wUAdxdFtag6cLfNrPZ8cgw50+hzmPmV0jo:qaqfIUYAlrp3D4c7NZ8K0+hnqo
• TLSH: T14B37E0F35157ECDE36891B43FDFA622A3446D2487072CBA26489B32C957863DBE20D41
• Submitted as: normal_5fc59b3193e9e.pdf
• File type: pdf · Size: 70695 bytes
• Verdict: suspicious (44/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ggtraff.ru/123?utm_term=the+elder+sister-like+one, https://static1.squarespace.com/static/5fc00a5311f6a4198480ec6e/t/5fc2ae81173fb5383bfb2bcd/1606594178610/karo_syrup_for_constipation_1_year_old.pdf, https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf63d3485235c868aeff0/1606284863062/cateye_enduro_8_turn_off.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ggtraff.ru/123?utm_term=the+elder+sister-like+one
• https://static1.squarespace.com/static/5fc00a5311f6a4198480ec6e/t/5fc2ae81173fb5383bfb2bcd/1606594178610/karo_syrup_for_constipation_1_year_old.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf63d3485235c868aeff0/1606284863062/cateye_enduro_8_turn_off.pdf
• https://cdn-cms.f-static.net/uploads/4385859/normal_5faab53a1a42e.pdf
• https://static1.squarespace.com/static/5fc2ba1840f1034a5cb4c0bb/t/5fc4f8af7acac6192a5d101f/1606744240538/52389444790.pdf
• https://static1.squarespace.com/static/5fc16e55e9fc3622d525ddac/t/5fc57340a97599144eb21a0e/1606775618778/star_wars_battlefront_2_legacy_mod.pdf
• https://static1.squarespace.com/static/5fc174bfa5bc066edfa992ec/t/5fc2a147f3de5e49b5ba80fb/1606590792949/zarera.pdf
• https://s3.amazonaws.com/lumixi/61696933845.pdf
• https://s3.amazonaws.com/memul/social_anxiety_disorder_recognition_assessment_and_treatment.pdf
• https://static1.squarespace.com/static/5fc1939ac6d964583626ee44/t/5fc351e83f75b166433ea18d/1606636009544/greenworks_2000_psi_pressure_washer_manual.pdf
• https://static1.squarespace.com/static/5fc0e2740a2757459be2c9b8/t/5fc5738ebc819f1cf4917b3a/1606775694282/86225284523.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf6719cb3e0f577147a506/1606379289696/51958463615.pdf
• https://static1.squarespace.com/static/5fc0f88bd26ff1194f740ef3/t/5fc127491972c46e3cc7bb75/1606494027157/fetipoparoneruwafitan.pdf
• https://static1.squarespace.com/static/5fc0eb79e5c7695ca99bb922/t/5fc3dd364e98326c0287e010/1606671678118/whats_the_answer_to_the_llama_riddle.pdf
• https://static1.squarespace.com/static/5fc0e9e3bda9c57a97be47bf/t/5fc15c96eaf37e3b64cf144c/1606507670479/31383060249.pdf
• https://static1.squarespace.com/static/5fc1015360f2895dc1e86a3c/t/5fc3fc49f3de5e49b5e0116b/1606679633028/dark_souls_timeline.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• static1.squarespace.com
• cdn-cms.f-static.net
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report