SUSPICIOUS — normal_5f88bd85be40b.pdf
SUSPICIOUS — normal_5f88bd85be40b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f4ea777a689ee35beafe75d4711616ed31bebf81ee3977f27377b94c80527e7e - SHA-1:
46aee7a06feac9d487e86e5ec8c32eecd700b31a - MD5:
723355e6c1b026c0ab467653ef98ea6b - ssdeep:
768:2NgGzpDMpD2rjt73+/VTukZPQCVuABCJmOiuRoQHQGefDMp4pWimbph:VGFQpDFxCJmOiuRCGefDMilmbph - TLSH:
T11F33AEF754DBDD4C7A8BAB07ACB61259608DC288A227972058CC736CD0BC5BEBF10561 - Submitted as: normal_5f88bd85be40b.pdf
- File type: pdf · Size: 50040 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=english+language+communication+skills+book+pdf, https://cdn-cms.f-static.net/uploads/4365563/normal_5f886521c1cad.pdf, https://cdn-cms.f-static.net/uploads/4369307/normal_5f889a1077b79.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
1036 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- desktop-hsgcbep
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- ff02::1:3
- 224.0.0.252
- ff02::1
- 10.240.0.1
- ff02::16
- 10.240.0.255
- 224.0.0.22
- 255.255.255.255
- ff02::1:2
- ff02::fb
- 224.0.0.251
- 185.125.190.58
- 185.125.190.57
- ff02::2
Dropped files
- root_.cache_dconf_user -
96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7
Embedded URLs
- https://gettraff.ru/123?keyword=english+language+communication+skills+book+pdf
- https://cdn-cms.f-static.net/uploads/4365563/normal_5f886521c1cad.pdf
- https://cdn-cms.f-static.net/uploads/4369307/normal_5f889a1077b79.pdf
- https://cdn-cms.f-static.net/uploads/4369797/normal_5f883fa3e6f36.pdf
- https://cdn-cms.f-static.net/uploads/4366313/normal_5f8721f7ae6ed.pdf
- https://cdn.shopify.com/s/files/1/0493/0925/3791/files/30319918087.pdf
- https://cdn.shopify.com/s/files/1/0478/3498/8703/files/jarimesuweruzekefetif.pdf
- https://cdn.shopify.com/s/files/1/0485/0876/4321/files/34200731507.pdf
- https://uploads.strikinglycdn.com/files/70a1312f-c0b6-4ec2-b222-e7c6acec6a0b/mabajuzowutovixir.pdf
- https://uploads.strikinglycdn.com/files/901eb92a-3431-4a14-80d1-fdcb114bf114/tutobi.pdf
- https://uploads.strikinglycdn.com/files/d8826819-dc30-4116-b18d-691ddd8e757e/4562298459.pdf
- https://uploads.strikinglycdn.com/files/93836c7b-d3c2-4a0d-9b31-1ac2ed4afd3e/maridopagokilivemetakobe.pdf
- https://uploads.strikinglycdn.com/files/90ef6128-8062-4760-ab7b-07bafe84b426/wemixijizatuvulibabugimik.pdf
- https://cdn.shopify.com/s/files/1/0496/6763/7411/files/govari.pdf
- https://cdn.shopify.com/s/files/1/0481/9343/7850/files/how_to_fix_a_comma_splice.pdf
- https://cdn.shopify.com/s/files/1/0481/6896/0149/files/avast_mobile_security_user_guide.pdf
- https://cdn.shopify.com/s/files/1/0266/9392/7111/files/asphalt_9_soundtrack.pdf
- https://cdn.shopify.com/s/files/1/0481/4808/6939/files/glyph_of_health_ingredients_eso.pdf
- https://legadiduzavof.weebly.com/uploads/1/3/2/6/132681829/potakafirawufotop.pdf
- https://pepotoxuxomupav.weebly.com/uploads/1/3/1/4/131483830/d8a1fcb.pdf
- https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/0cbd7f35736ab.pdf
- https://cdn-cms.f-static.net/uploads/4369162/normal_5f88ad9c4e477.pdf
- https://cdn-cms.f-static.net/uploads/4365656/normal_5f877177e1fd7.pdf
- https://cdn-cms.f-static.net/uploads/4372673/normal_5f88bc95a000d.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- cdn.shopify.com
- uploads.strikinglycdn.com
- legadiduzavof.weebly.com
- pepotoxuxomupav.weebly.com
- jakedekokobara.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report