SUSPICIOUS — normal_5f8a330518f97.pdf
SUSPICIOUS — normal_5f8a330518f97.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
f2bbfbbc1ac1beb3c7667d26f2efb4301e5a7bfaed08dfbd9c53a064d129d7ef - SHA-1:
815211202f26f8afe0e237bc3a53c6f43952cf14 - MD5:
efd00a899ee6d768a721a1d2ab3a5a65 - ssdeep:
768:HgGzpDqpp5xOXo+dSOdRr7ZDL91xD4Y3S/cnPrqiCHSUJdSeproqhkGAic2:AGFupQnWiCHSwdBsoAic2 - TLSH:
T11F317CF35097FE8C3B8B5B43BDA70169254AC7896036E750188C2B2CD5BCAED7E50660 - Submitted as: normal_5f8a330518f97.pdf
- File type: pdf · Size: 39788 bytes
- Verdict: suspicious (35/100)
Detections (3 of 50 engines)
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 35/100 is the fusion of 2 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=respironics+bipap+avaps+manual, https://cdn.shopify.com/s/files/1/0497/1518/3777/files/android_pie_multitasking_apk.pdf, https://cdn.shopify.com/s/files/1/0495/9204/1624/files/bunn_velocity_brew_10_cup.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/123?keyword=respironics+bipap+avaps+manual
- https://cdn.shopify.com/s/files/1/0497/1518/3777/files/android_pie_multitasking_apk.pdf
- https://cdn.shopify.com/s/files/1/0495/9204/1624/files/bunn_velocity_brew_10_cup.pdf
- https://cdn.shopify.com/s/files/1/0433/6759/6191/files/colin_kaepernick_t_shirt_canada.pdf
- https://cdn.shopify.com/s/files/1/0479/2945/8852/files/98824921051.pdf
- https://cdn-cms.f-static.net/uploads/4374371/normal_5f88f17e50727.pdf
- https://cdn-cms.f-static.net/uploads/4373755/normal_5f88b67b2b24c.pdf
- https://cdn-cms.f-static.net/uploads/4369174/normal_5f8994615b499.pdf
- https://cdn-cms.f-static.net/uploads/4365662/normal_5f88ab47722a7.pdf
- https://cdn-cms.f-static.net/uploads/4366346/normal_5f88b4b311f0e.pdf
- https://cdn.shopify.com/s/files/1/0483/0501/2898/files/burilimuxuzaxamerazide.pdf
- https://cdn.shopify.com/s/files/1/0501/1449/4614/files/round_robin_algorithm_golang.pdf
- https://cdn.shopify.com/s/files/1/0437/4816/3738/files/does_ps3_games_work_on_ps4_console.pdf
- https://cdn.shopify.com/s/files/1/0435/3648/2458/files/60598335197.pdf
- https://cdn.shopify.com/s/files/1/0501/6902/0578/files/nutrition_label_guidelines_canada.pdf
- https://cdn-cms.f-static.net/uploads/4371261/normal_5f898759df82b.pdf
- https://cdn-cms.f-static.net/uploads/4366358/normal_5f8a1d5d238ce.pdf
- https://cdn-cms.f-static.net/uploads/4365627/normal_5f87e099ad677.pdf
- https://cdn.shopify.com/s/files/1/0481/1207/4915/files/80772098918.pdf
- https://cdn.shopify.com/s/files/1/0435/8560/1695/files/7280979298.pdf
- https://cdn.shopify.com/s/files/1/0492/9326/3004/files/57701033770.pdf
- https://cdn.shopify.com/s/files/1/0433/6313/9733/files/piwimovaluzomiwutefoxe.pdf
- https://cdn.shopify.com/s/files/1/0480/4372/0868/files/pemikebuzimananovi.pdf
- https://cdn.shopify.com/s/files/1/0483/4695/5929/files/bukiw.pdf
- https://cdn.shopify.com/s/files/1/0434/8513/5014/files/latin_personal_pronouns_song.pdf
Embedded domains
- gettraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report