MALICIOUS — normal_5fe35920d6f9c.pdf

MALICIOUS — normal_5fe35920d6f9c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 01d869a739941493db9767d27dc4f860e7c27cd09e1d5eb06bcbf7e14ec7da89
• SHA-1: b764ce63d28fe8a8691b951efe747b71fa53986e
• MD5: 68a038611abaea0745e9e490119ff1c9
• ssdeep: 1536:RfUXf1pg6PdxD6otGNSFfcXEYxuhDLm1TIqRjJHW0gm1aiHC0IcNViL:JkdvxmCW3YGRIAjRBpgL
• TLSH: T15237E1F3E25BDC8C76C89B53ABE6582C6899D68C6032D6305448B72CC47D6ED2D60C63
• Submitted as: normal_5fe35920d6f9c.pdf
• File type: pdf · Size: 70768 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffnew.ru/123?utm_term=draw+an+island+with+your+eyes+closed, https://cdn.sqhk.co/wezopexa/ihicohb/gp_sheet_weight_chart.pdf, https://cdn-cms.f-static.net/uploads/4367643/normal_5fa7bce0d3b06.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffnew.ru/123?utm_term=draw+an+island+with+your+eyes+closed
• https://s3.amazonaws.com/susopuzupure/porurofilirisa.pdf
• https://cdn.sqhk.co/wezopexa/ihicohb/gp_sheet_weight_chart.pdf
• https://s3.amazonaws.com/wazagidonux/fawofibekuvuxofiti.pdf
• https://cdn-cms.f-static.net/uploads/4367643/normal_5fa7bce0d3b06.pdf
• https://sinonulu.weebly.com/uploads/1/3/4/6/134654736/sejud.pdf
• https://uploads.strikinglycdn.com/files/49817fc3-ec58-49e1-bfe7-06a36e89e979/kofumimokajorobizerapir.pdf
• https://s3.amazonaws.com/debiwelof/7244519193.pdf
• https://s3.amazonaws.com/sirilagewuga/accountancy_project_class_12_cbse_guidelines.pdf
• https://cdn.sqhk.co/jebixusugak/hdx8Hie/84003889501.pdf
• https://lodirunesu.weebly.com/uploads/1/3/0/8/130874391/9225f5590a2.pdf
• https://kumenesasewoton.weebly.com/uploads/1/3/4/7/134773405/zutadomew.pdf
• https://s3.amazonaws.com/jozaponi/60786391067.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffnew.ru
• s3.amazonaws.com
• cdn.sqhk.co
• cdn-cms.f-static.net
• sinonulu.weebly.com
• uploads.strikinglycdn.com
• lodirunesu.weebly.com
• kumenesasewoton.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report