SUSPICIOUS — normal_5f9e8e21db7b9.pdf

SUSPICIOUS — normal_5f9e8e21db7b9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: f48366ffb0fac43ddbc5c1f2c5207f2a03886696c4c96bc2e4490c28acefea4f
• SHA-1: 2b4fd8f358f6bca3b4ccdb8500578f5cfb1b82ba
• MD5: 2fa6a8be19f50b0eac4494e2859230c6
• ssdeep: 1536:ZGFZ2BNtqSB1tNTB+PKoa+QBABmEM24gWFspXPzO2TKGnD6:sFZEN3B/NTKK0B9sgkMXPzO2o
• TLSH: T17038E1F35163DD5C6A57CF576EEA24626109C28D2123EA2104DD336CD9BC2AC7F90EA0
• Submitted as: normal_5f9e8e21db7b9.pdf
• File type: pdf · Size: 83828 bytes
• Verdict: suspicious (44/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The suspicious score of 44/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: https://ttraff.club/123?keyword=europa+universalis+4+game+guide, https://cdn.shopify.com/s/files/1/0502/7987/4722/files/22708757278.pdf, https://cdn.shopify.com/s/files/1/0502/9865/0789/files/40593751375.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://ttraff.club/123?keyword=europa+universalis+4+game+guide
• https://cdn.shopify.com/s/files/1/0502/7987/4722/files/22708757278.pdf
• https://cdn.shopify.com/s/files/1/0502/9865/0789/files/40593751375.pdf
• https://s3.amazonaws.com/leguvefu/71218731151.pdf
• https://s3.amazonaws.com/vonusirukete/bovevujuwovewatisozeje.pdf
• https://cdn.shopify.com/s/files/1/0505/0672/7579/files/the_quick_and_easy_way_to_effective_speaking_free_download.pdf
• https://cdn.shopify.com/s/files/1/0497/5080/2595/files/25631987987.pdf
• https://cdn.shopify.com/s/files/1/0484/9598/4795/files/agile_project_management_with_scrum_microsoft_professional.pdf
• https://cdn-cms.f-static.net/uploads/4384470/normal_5f8d6d8dab465.pdf
• https://cdn.shopify.com/s/files/1/0496/4450/3191/files/tequesta_drum_circle.pdf
• https://cdn.shopify.com/s/files/1/0502/1895/9048/files/robinair_17800b_parts_manual.pdf
• https://cdn.shopify.com/s/files/1/0439/3811/9838/files/lotos_plasma_cutter_ltp5000d_manual.pdf
• https://cdn.shopify.com/s/files/1/0484/4424/4118/files/body_composition_exercises_list.pdf
• https://cdn-cms.f-static.net/uploads/4368506/normal_5f91297d4deba.pdf
• https://cdn.shopify.com/s/files/1/0494/4091/5615/files/checkbooks_guide_to_health_plans.pdf
• https://cdn.shopify.com/s/files/1/0437/0061/7381/files/vimiloro.pdf
• https://cdn-cms.f-static.net/uploads/4369508/normal_5f8935af36f2f.pdf
• https://cdn-cms.f-static.net/uploads/4387932/normal_5f9dca37445a9.pdf
• https://cdn.shopify.com/s/files/1/0430/1688/0281/files/bittorrent_android_download_folder.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• s3.amazonaws.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report