SUSPICIOUS — normal_5f90d846d9408.pdf
SUSPICIOUS — normal_5f90d846d9408.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
f523b83fbdd298ec0e1a7055fc12b7d42dfd43ecd418cf72b74ee79f362b45b7 - SHA-1:
7529ce5fd82bada52367ee484fd403e35775a302 - MD5:
3ff88aacbb363224faa57361440f95cb - ssdeep:
768:sgGzpDjpLg6BuGm3W2AOYEpdNUztIYUDZAs87q9lGhoITZ9GjV+H8WYIrizEjv4i:pGFnpLmYAus87q9k9GjkcWYIrCI55 - TLSH:
T1E2337DF310F7ED4D3A8F5F13A9AB2169618AE788613397A04088772CD47CAFD2E10655 - Submitted as: normal_5f90d846d9408.pdf
- File type: pdf · Size: 48537 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.ru/123?keyword=super+mario+odyssey+guide+download, https://cdn.shopify.com/s/files/1/0504/3647/2992/files/vofelujagesos.pdf, https://cdn.shopify.com/s/files/1/0431/4365/9677/files/99316372379.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.ru/123?keyword=super+mario+odyssey+guide+download
- https://cdn.shopify.com/s/files/1/0504/3647/2992/files/vofelujagesos.pdf
- https://cdn.shopify.com/s/files/1/0431/4365/9677/files/99316372379.pdf
- https://cdn.shopify.com/s/files/1/0496/0567/3111/files/concrete_mix_design_calculation_excel_sheet.pdf
- https://cdn.shopify.com/s/files/1/0498/3809/6546/files/pulled_in_a_new_direction_lyrics_karaoke.pdf
- https://cdn.shopify.com/s/files/1/0434/3175/5932/files/epidemiology_of_typhoid_fever_in_nigeria.pdf
- https://cdn-cms.f-static.net/uploads/4367645/normal_5f874c2bd4bc2.pdf
- https://cdn-cms.f-static.net/uploads/4375350/normal_5f8b9de7d7631.pdf
- https://cdn-cms.f-static.net/uploads/4365536/normal_5f87ea90be09f.pdf
- https://cdn-cms.f-static.net/uploads/4366057/normal_5f87835390b7b.pdf
- https://cdn-cms.f-static.net/uploads/4380082/normal_5f8d3e3b980c0.pdf
- https://cdn-cms.f-static.net/uploads/4402000/normal_5f90c03fabff8.pdf
- https://cdn-cms.f-static.net/uploads/4369149/normal_5f8894bc1db45.pdf
- https://cdn-cms.f-static.net/uploads/4375077/normal_5f909706e9954.pdf
- https://cdn-cms.f-static.net/uploads/4366374/normal_5f90bbbc4e693.pdf
- https://cdn-cms.f-static.net/uploads/4367645/normal_5f898205b39c0.pdf
- https://s3.amazonaws.com/mijedusovineti/jozexafizugotulok.pdf
- https://s3.amazonaws.com/fasanag/stretches_for_runner_s_knee.pdf
- https://s3.amazonaws.com/susopuzupure/17840308346.pdf
- https://s3.amazonaws.com/gupuso/senubexotodumutexozetu.pdf
- https://s3.amazonaws.com/tadovu/57721943745.pdf
- https://cdn-cms.f-static.net/uploads/4366000/normal_5f873febacce6.pdf
- https://cdn-cms.f-static.net/uploads/4371812/normal_5f8e759164fee.pdf
- https://cdn-cms.f-static.net/uploads/4367674/normal_5f88ac75a047c.pdf
- https://cdn-cms.f-static.net/uploads/4388627/normal_5f8f3487c6280.pdf
Embedded domains
- ttraff.ru
- cdn.shopify.com
- cdn-cms.f-static.net
- s3.amazonaws.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report