SUSPICIOUS — normal_5f899b3556b01.pdf
SUSPICIOUS — normal_5f899b3556b01.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100). 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f5db63fe69c192f9804d9ef907600bb995f9f5241e94cb4e6ec6eaa69e930d6f - SHA-1:
44957995e21a8c1eca00ea2fc9314e370f9807d1 - MD5:
6ef264c3c8a52264f4c4d14727a58c27 - ssdeep:
1536:nGFcpLEj34Q7snOddBlLs/vYA8XytaVHnkcFbvP:GFcpL04QRB1s/vY1XwaNf5 - TLSH:
T15E36AFF3D0A7DD6C3A4DAB1779A110795C8ACA4960E29770088C679FF47CAAD5F00632 - Submitted as: normal_5f899b3556b01.pdf
- File type: pdf · Size: 67288 bytes
- Verdict: suspicious (58/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 58/100 is the fusion of 4 weighted signals:
- Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/aad5e5a3-d4bc-44c2-ac8d-24808635bc6f/91213531355.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://ttraff.ru/123?keyword=android+gradle+dependencies+flavor, https://uploads.strikinglycdn.com/files/aad5e5a3-d4bc-44c2-ac8d-24808635bc6f/91213531355.pdf, https://uploads.strikinglycdn.com/files/0319ffd7-8463-43f7-aee6-da58b276b1f8/24473796565.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.ru/123?keyword=android+gradle+dependencies+flavor
- https://uploads.strikinglycdn.com/files/aad5e5a3-d4bc-44c2-ac8d-24808635bc6f/91213531355.pdf
- https://uploads.strikinglycdn.com/files/0319ffd7-8463-43f7-aee6-da58b276b1f8/24473796565.pdf
- https://uploads.strikinglycdn.com/files/f9ee28e1-71a1-4dc0-83ce-98d0efc6fd0b/26313656393.pdf
- https://cdn.shopify.com/s/files/1/0496/0557/4819/files/dowos.pdf
- https://gamupizesusaza.weebly.com/uploads/1/3/1/3/131398140/vapujenipujij_lutam_jasixajepubese_lumedilozen.pdf
- https://migirebunimalab.weebly.com/uploads/1/3/1/3/131383914/navojugogefal.pdf
- https://cdn.shopify.com/s/files/1/0436/9127/8486/files/zozuxowowudezalej.pdf
- https://cdn.shopify.com/s/files/1/0483/8676/9053/files/pifuj.pdf
- https://cdn.shopify.com/s/files/1/0500/5964/1025/files/49123545890.pdf
- https://cdn.shopify.com/s/files/1/0431/8229/3151/files/office_space_meme.pdf
- https://cdn.shopify.com/s/files/1/0483/4630/0576/files/zusitevu.pdf
- https://fewevivib.weebly.com/uploads/1/3/0/8/130813821/5967272.pdf
- https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/8742796.pdf
- https://xebikazogede.weebly.com/uploads/1/3/2/7/132740990/218b302b222536.pdf
- https://viweposedijul.weebly.com/uploads/1/3/1/0/131070314/lexibefe.pdf
- https://tipefejiri.weebly.com/uploads/1/3/0/9/130969755/punadax-kazugokov.pdf
- https://cdn.shopify.com/s/files/1/0480/9703/4393/files/lajabisunuxuluwikok.pdf
- https://cdn.shopify.com/s/files/1/0432/3269/0339/files/list_of_affixes_that_mean_without.pdf
- https://cdn.shopify.com/s/files/1/0438/3296/7318/files/crusaders_of_light_warrior_executioner_guide.pdf
- https://cdn.shopify.com/s/files/1/0431/3756/4838/files/update_android_pie_vivo_y91.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
Embedded domains
- ttraff.ru
- uploads.strikinglycdn.com
- cdn.shopify.com
- gamupizesusaza.weebly.com
- migirebunimalab.weebly.com
- fewevivib.weebly.com
- mogilifus.weebly.com
- xebikazogede.weebly.com
- viweposedijul.weebly.com
- tipefejiri.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report