SUSPICIOUS — normal_5f873d1647d50.pdf
SUSPICIOUS — normal_5f873d1647d50.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
f3c78f5969fc895eadec4211612e08bf83668c2039c17a397eee07f8e43a3d55 - SHA-1:
24e0a87131a58bf68e94e23f56c193499d2b3466 - MD5:
7f6adba2862b97f00c1bf8ba17217dfd - ssdeep:
1536:jGFweQlp5S0DJT2RkrRkHpvLisOGyyh2ZDwPWLw2KpET:yFweQlp5SACRCRkHpvvOGDh+Mxli - TLSH:
T153358DF351A7DD8C79C79B4369EB142DA486DB482132DB944598773CC4FC6BC6E20A20 - Submitted as: normal_5f873d1647d50.pdf
- File type: pdf · Size: 60110 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=unfold+premium+apk+mod+latest+version, https://cdn-cms.f-static.net/uploads/4366630/normal_5f873179cd054.pdf, https://cdn-cms.f-static.net/uploads/4366305/normal_5f871bdd4a560.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/123?keyword=unfold+premium+apk+mod+latest+version
- https://cdn-cms.f-static.net/uploads/4366630/normal_5f873179cd054.pdf
- https://cdn-cms.f-static.net/uploads/4366305/normal_5f871bdd4a560.pdf
- https://cdn-cms.f-static.net/uploads/4365525/normal_5f872f4cc4e96.pdf
- https://cdn-cms.f-static.net/uploads/4365646/normal_5f86f5c4dd576.pdf
- https://uploads.strikinglycdn.com/files/de0be69e-3974-4045-9bce-5c0c6619e072/55605789659.pdf
- https://uploads.strikinglycdn.com/files/84c9bb2f-f5ca-4df3-9075-bce69e34eb60/nirexuj.pdf
- https://uploads.strikinglycdn.com/files/334d1521-09f0-4796-806e-1cdd24563b94/99744670549.pdf
- https://site-1037846.mozfiles.com/files/1037846/soluzodupexowanamatalusa.pdf
- https://site-1043933.mozfiles.com/files/1043933/54341592526.pdf
- https://site-1039224.mozfiles.com/files/1039224/tigofab.pdf
- https://site-1044239.mozfiles.com/files/1044239/42908161280.pdf
- https://site-1044198.mozfiles.com/files/1044198/movilu.pdf
- https://site-1041282.mozfiles.com/files/1041282/10653974093.pdf
- https://site-1042674.mozfiles.com/files/1042674/visux.pdf
- https://site-1041483.mozfiles.com/files/1041483/razegufe.pdf
- https://site-1038495.mozfiles.com/files/1038495/wojunixefakabadup.pdf
- https://site-1036910.mozfiles.com/files/1036910/kunuxag.pdf
- https://cdn.shopify.com/s/files/1/0433/2892/9945/files/mipalisumijofenenuputizox.pdf
- https://cdn.shopify.com/s/files/1/0435/3179/6634/files/family_communication_cohesion_and_change_10th_edition_free.pdf
- https://cdn.shopify.com/s/files/1/0430/8333/3786/files/21410731121.pdf
- https://cdn.shopify.com/s/files/1/0432/2174/5822/files/bupaxerazovagoxe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- site-1037846.mozfiles.com
- site-1043933.mozfiles.com
- site-1039224.mozfiles.com
- site-1044239.mozfiles.com
- site-1044198.mozfiles.com
- site-1041282.mozfiles.com
- site-1042674.mozfiles.com
- site-1041483.mozfiles.com
- site-1038495.mozfiles.com
- site-1036910.mozfiles.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report