MALICIOUS — b82b4aedbb9968.pdf

MALICIOUS — b82b4aedbb9968.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 011e4ce70b325251d16c24c6ae145c4e5c76a806df54ac13900d5367df47728e
• SHA-1: 61450a73caaf7d2aa14b039553ff57f3b6e5ab1f
• MD5: aada811c9ea543d9b1e48d6110827e82
• ssdeep: 1536:1A/Ssx5z1YESS4Y3vRvuGSjwE9DBSUZaxguOLvsqGXBsLW4r:eKe5z1Zd4Y3vQ1wEJRaxguObsqGXBsR
• TLSH: T17037D0F76157CE88B1495B13F9E9256D948FE78A3133DB9018887A2C84BC6BC7E10B41
• Submitted as: b82b4aedbb9968.pdf
• File type: pdf · Size: 72706 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffmen.ru/wb?keyword=music%20videos%202020%20marcheal, https://uploads.strikinglycdn.com/files/636f7dce-db38-4883-aadd-34db602749e9/nuweduposuwuwiwutizub.pdf, https://uploads.strikinglycdn.com/files/1d0470db-2cfb-4e67-acea-3524d4297e1a/xitotoxal.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffmen.ru/wb?keyword=music%20videos%202020%20marcheal
• https://uploads.strikinglycdn.com/files/636f7dce-db38-4883-aadd-34db602749e9/nuweduposuwuwiwutizub.pdf
• https://uploads.strikinglycdn.com/files/1d0470db-2cfb-4e67-acea-3524d4297e1a/xitotoxal.pdf
• https://uploads.strikinglycdn.com/files/3580806c-ea5e-4405-9a78-7e9cef177982/5670451287.pdf
• https://cdn-cms.f-static.net/uploads/4368488/normal_5f99d4c16e54f.pdf
• https://cdn-cms.f-static.net/uploads/4421209/normal_5f96878d5118b.pdf
• https://uploads.strikinglycdn.com/files/fa2b7813-a44a-47f1-aa13-80cc377d53de/singing_warm_ups.pdf
• https://uploads.strikinglycdn.com/files/8a9a1291-b945-4d72-9ce5-20671d370f64/wexupedojudibotatale.pdf
• https://xawewidijaxiju.weebly.com/uploads/1/3/4/2/134266046/ripemamadabon.pdf
• https://cdn-cms.f-static.net/uploads/4452161/normal_5fa8b19e353ac.pdf
• https://rulomegujenuguv.weebly.com/uploads/1/3/4/3/134329868/3488305.pdf
• https://uploads.strikinglycdn.com/files/6229eab0-272e-4ad3-9fa4-a8911da11400/wowidarozifudu.pdf
• https://uploads.strikinglycdn.com/files/c8c309ee-e118-4f84-b12a-a5a3511de4ed/97356104302.pdf
• https://xojerajap.weebly.com/uploads/1/3/1/3/131384359/3373854.pdf
• https://fisezofibidan.weebly.com/uploads/1/3/4/3/134316577/1a0a6d860be.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffmen.ru
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• xawewidijaxiju.weebly.com
• rulomegujenuguv.weebly.com
• xojerajap.weebly.com
• fisezofibidan.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report