SUSPICIOUS — normal_5f8d5839b9fce.pdf
SUSPICIOUS — normal_5f8d5839b9fce.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
f5a316ddc0205954c32e2f6b1be4244014de594251912372f8648c168e5d2563 - SHA-1:
aa148b4d2b01dc7b7589400edbb4a83c2c484e62 - MD5:
3acfc7917c76935cf33f56b4fa133f3f - ssdeep:
768:3gGzpDbpLJnGLXLoubKMpDhRNz1YkNnoDpbw9wpJLgHWD3XOfKfzsy5P9S:QGFPpNUxlNnoDp0wpJLgHWDuyQy5P9S - TLSH:
T1CC329DF36097ECCC7E869B13BDA610959549CB8DA2339B90458C777CC4BC6BCAE10960 - Submitted as: normal_5f8d5839b9fce.pdf
- File type: pdf · Size: 43697 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://ttraff.club/123?keyword=download+guitar+hero+3+naruto+shippuden+apk, https://folarudivol.weebly.com/uploads/1/3/1/8/131871739/189f0cc6e3.pdf, https://wajiresejepo.weebly.com/uploads/1/3/0/7/130774962/sutagu.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://ttraff.club/123?keyword=download+guitar+hero+3+naruto+shippuden+apk
- https://folarudivol.weebly.com/uploads/1/3/1/8/131871739/189f0cc6e3.pdf
- https://wajiresejepo.weebly.com/uploads/1/3/0/7/130774962/sutagu.pdf
- https://mamunazeve.weebly.com/uploads/1/3/0/8/130814121/5784214.pdf
- https://pimupaxepa.weebly.com/uploads/1/3/1/8/131857198/wexaxifup.pdf
- https://fawefugixizim.weebly.com/uploads/1/3/1/3/131383791/nevate.pdf
- https://leruzifu.weebly.com/uploads/1/3/2/3/132302941/rexuwatuxubite.pdf
- https://cdn-cms.f-static.net/uploads/4365582/normal_5f87461db06fb.pdf
- https://cdn-cms.f-static.net/uploads/4373782/normal_5f88d75c86ea5.pdf
- https://cdn-cms.f-static.net/uploads/4366007/normal_5f8729dd62de0.pdf
- https://cdn-cms.f-static.net/uploads/4366408/normal_5f8ceb60a08ac.pdf
- https://cdn.shopify.com/s/files/1/0483/1530/2043/files/stardew_valley_crop_profit_spreadsheet.pdf
- https://cdn.shopify.com/s/files/1/0485/2678/6715/files/xetimuxumenapigowe.pdf
- https://cdn.shopify.com/s/files/1/0432/9462/1862/files/talleres_para_matrimonios_cristianos_ppt.pdf
- https://cdn.shopify.com/s/files/1/0266/8894/6346/files/story_sequencing_worksheets_for_grade_4.pdf
- https://cdn-cms.f-static.net/uploads/4368982/normal_5f8a30a144398.pdf
- https://cdn-cms.f-static.net/uploads/4380881/normal_5f8b45c397d2a.pdf
- https://cdn-cms.f-static.net/uploads/4370266/normal_5f891e8c3a5d5.pdf
- https://cdn-cms.f-static.net/uploads/4370053/normal_5f8d0e44034e3.pdf
- https://cdn-cms.f-static.net/uploads/4371505/normal_5f89d544b2bb6.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
Embedded domains
- ttraff.club
- folarudivol.weebly.com
- wajiresejepo.weebly.com
- mamunazeve.weebly.com
- pimupaxepa.weebly.com
- fawefugixizim.weebly.com
- leruzifu.weebly.com
- cdn-cms.f-static.net
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report