SUSPICIOUS — normal_5f8754cd99803.pdf
SUSPICIOUS — normal_5f8754cd99803.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 3 of 50 detection engines flagged it.
Identification
- SHA-256:
fc865ada443c90ea3ae000559dbbb794fc5ad699a3b7b8d790f99854a48491a5 - SHA-1:
4473b493ac8ac23044c3e6a4987661b851376691 - MD5:
e897c65ccafdbad34535a49d958d5bb4 - ssdeep:
768:NgGzpDweFDwc30stn0bYMDinPmPsqkxWy7JIpSfbW1e3stnC0:uGFEeFNOP98W62SfbW1VtC0 - TLSH:
T1E2315CF31197ED8C7A8B6B03AEE61199648EC34C6272D7604498776CC47CABD7E10A60 - Submitted as: normal_5f8754cd99803.pdf
- File type: pdf · Size: 40867 bytes
- Verdict: suspicious (44/100)
Detections (3 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/123?keyword=infantino+grocery+cart+cover+instructions, https://cdn.shopify.com/s/files/1/0500/7350/1884/files/51130032033.pdf, https://cdn.shopify.com/s/files/1/0266/9235/4245/files/ar_verb_worksheets_in_spanish.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/123?keyword=infantino+grocery+cart+cover+instructions
- https://cdn.shopify.com/s/files/1/0500/7350/1884/files/51130032033.pdf
- https://cdn.shopify.com/s/files/1/0266/9235/4245/files/ar_verb_worksheets_in_spanish.pdf
- https://cdn.shopify.com/s/files/1/0499/3626/9470/files/presocratic_philosophers.pdf
- https://site-1036791.mozfiles.com/files/1036791/14619285140.pdf
- https://site-1038927.mozfiles.com/files/1038927/49599954167.pdf
- https://site-1041068.mozfiles.com/files/1041068/narigegebuwobavaz.pdf
- https://cdn.shopify.com/s/files/1/0434/9709/5333/files/4l60e_shift_kit_install.pdf
- https://cdn.shopify.com/s/files/1/0497/9851/2803/files/her_private_life_ost_lyrics_english.pdf
- https://cdn-cms.f-static.net/uploads/4366048/normal_5f86f8e4e7c31.pdf
- https://cdn-cms.f-static.net/uploads/4365607/normal_5f8724c270615.pdf
- https://cdn-cms.f-static.net/uploads/4366029/normal_5f86f92abc543.pdf
- https://cdn-cms.f-static.net/uploads/4367005/normal_5f874492b7af7.pdf
- https://cdn-cms.f-static.net/uploads/4366321/normal_5f870dda749dd.pdf
- https://site-1044146.mozfiles.com/files/1044146/dunewokezimifevon.pdf
- https://site-1040442.mozfiles.com/files/1040442/85587610759.pdf
- https://site-1038836.mozfiles.com/files/1038836/90390513765.pdf
- https://site-1040312.mozfiles.com/files/1040312/52787336042.pdf
- https://uploads.strikinglycdn.com/files/4009b0a4-a0ed-43ac-a2e6-0dbba0f9e67b/13430698707.pdf
- https://uploads.strikinglycdn.com/files/1dbdc3b2-7461-4122-846d-7d2239e62718/30740633419.pdf
- https://uploads.strikinglycdn.com/files/02e1d250-0048-4188-989c-3a0f7fe6135d/83842708369.pdf
- https://uploads.strikinglycdn.com/files/74883ed0-45e9-4f72-aed4-120f21074985/2456068003.pdf
- https://uploads.strikinglycdn.com/files/392b7ef3-bcf2-44bc-93f4-edfd8c4609a8/14910444647.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- gettraff.ru
- cdn.shopify.com
- site-1036791.mozfiles.com
- site-1038927.mozfiles.com
- site-1041068.mozfiles.com
- cdn-cms.f-static.net
- site-1044146.mozfiles.com
- site-1040442.mozfiles.com
- site-1038836.mozfiles.com
- site-1040312.mozfiles.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report