SUSPICIOUS — normal_5f8720fad0ddb.pdf
SUSPICIOUS — normal_5f8720fad0ddb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
f9bc6a875ff71a63c2677f6c819c4b736bf3dc5a86b871a33dba1a4490a985f2 - SHA-1:
98b42813f13efd79e0d37a3fed496ab67c65527e - MD5:
689c8f935f6f44ae778fac1a7df86df6 - ssdeep:
768:MzgGzpDgnesOItbbWqjoZvCrFRKJojIUC/LU3wk/I/cufAl0QUpmU+UGmXqsXlPV:1GFUessBUCFk/IUSQ2mU+UGm6KlPvK4j - TLSH:
T1F7336CF310A7DD8C7A8BAB03ADFB1169608AC3486277DB90449C762C94BC5BD7F10961 - Submitted as: normal_5f8720fad0ddb.pdf
- File type: pdf · Size: 48093 bytes
- Verdict: suspicious (44/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=download+insaniquarium+mod+android+1, https://site-1039133.mozfiles.com/files/1039133/53327617218.pdf, https://site-1036628.mozfiles.com/files/1036628/3480789119.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- https://gettraff.ru/123?keyword=download+insaniquarium+mod+android+1
- https://site-1039133.mozfiles.com/files/1039133/53327617218.pdf
- https://site-1036628.mozfiles.com/files/1036628/3480789119.pdf
- https://site-1043365.mozfiles.com/files/1043365/17302632470.pdf
- https://site-1042343.mozfiles.com/files/1042343/bamumojowosilak.pdf
- https://site-1039349.mozfiles.com/files/1039349/musemovutobizofigux.pdf
- https://site-1041381.mozfiles.com/files/1041381/21844508871.pdf
- https://site-1038660.mozfiles.com/files/1038660/11681179097.pdf
- https://site-1048575.mozfiles.com/files/1048575/raseposopajubamunigew.pdf
- https://uploads.strikinglycdn.com/files/2d006540-a1d4-494e-9f33-faa187bb7714/wabokepoxuxixamuratezomet.pdf
- https://uploads.strikinglycdn.com/files/1291addd-03f2-49d3-b46b-2bdb21738f21/xelajivewufimajod.pdf
- https://uploads.strikinglycdn.com/files/10814f4f-0d69-4e3a-8e2d-ea48f175f535/sulonumeladabafixux.pdf
- https://uploads.strikinglycdn.com/files/84707217-f9d6-4098-8e27-17d1aae753a1/1617009802.pdf
- https://uploads.strikinglycdn.com/files/5ab9dd63-01f3-4f46-a5d4-694efb96a785/54875210738.pdf
- https://cdn.shopify.com/s/files/1/0430/7058/7029/files/clariel_the_lost_abhorsen_free_download.pdf
- https://cdn.shopify.com/s/files/1/0433/9361/3989/files/best_skyrim_modding_guide_reddit.pdf
- https://cdn.shopify.com/s/files/1/0477/6198/1596/files/24385633757.pdf
- https://mojivimimujovo.weebly.com/uploads/1/3/0/8/130874437/29e2ac3.pdf
- https://tavumake.weebly.com/uploads/1/3/2/7/132740551/lepimebosuxomu_fukixusa_famosulizik_sukoruzikazil.pdf
- https://jawowigo.weebly.com/uploads/1/3/0/7/130774982/6615122.pdf
- https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/tidivobinimigip-banez-batipafon.pdf
- https://cdn-cms.f-static.net/uploads/4365660/normal_5f87143106e87.pdf
- https://cdn-cms.f-static.net/uploads/4366048/normal_5f86fa9db6b07.pdf
- https://cdn-cms.f-static.net/uploads/4366035/normal_5f870df392a87.pdf
- https://cdn-cms.f-static.net/uploads/4365600/normal_5f870c40c1bdb.pdf
Embedded domains
- gettraff.ru
- site-1039133.mozfiles.com
- site-1036628.mozfiles.com
- site-1043365.mozfiles.com
- site-1042343.mozfiles.com
- site-1039349.mozfiles.com
- site-1041381.mozfiles.com
- site-1038660.mozfiles.com
- site-1048575.mozfiles.com
- uploads.strikinglycdn.com
- cdn.shopify.com
- mojivimimujovo.weebly.com
- tavumake.weebly.com
- jawowigo.weebly.com
- zoxuzuxebexot.weebly.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report