MALICIOUS — normal_5ff4c400a06bd.pdf

MALICIOUS — normal_5ff4c400a06bd.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 04e2a735c8c778deecaa1e1e211ab8ec2a0895a1f56aecf318aa646f4c87bfec
• SHA-1: dda5d4458619641918d202989a7dd0b6ba5d3474
• MD5: f054976421c1481ea7a69a6c21f6762f
• ssdeep: 1536:97mVKwixq8nUvUxK74RC1jVAWP7XedDH5wvNv+0jV1X7YM:xmVqxq8nUcw7IkOdiv3x1T
• TLSH: T14B37D1F771A7EC4D7AD9AF536AB6247E7089D2CC3226D620548876BCC47C9AC5D20C10
• Submitted as: normal_5ff4c400a06bd.pdf
• File type: pdf · Size: 75050 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!F054976421C1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafffe.ru/123?utm_term=army+disability+evaluation+system, https://vifefafu.weebly.com/uploads/1/3/4/8/134876142/190c55a44043ea.pdf, https://zuzimarubafa.weebly.com/uploads/1/3/4/7/134712841/de94576d.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://trafffe.ru/123?utm_term=army+disability+evaluation+system
• https://vifefafu.weebly.com/uploads/1/3/4/8/134876142/190c55a44043ea.pdf
• https://zuzimarubafa.weebly.com/uploads/1/3/4/7/134712841/de94576d.pdf
• https://cdn.sqhk.co/jogepirar/1hg1Dgf/list_of_kid_rock_songs_famousfix.pdf
• https://fiwisito.weebly.com/uploads/1/3/4/7/134715438/jipudewilegubiwib.pdf
• https://begagezegitajaj.weebly.com/uploads/1/3/1/3/131398046/jotekevivarurujod.pdf
• https://uploads.strikinglycdn.com/files/84819dca-986e-42c7-adab-d18d939d2403/980391021.pdf
• https://valogasode.weebly.com/uploads/1/3/4/3/134320371/betegazajomew.pdf
• https://niforobufuxir.weebly.com/uploads/1/3/4/5/134512868/4351525.pdf
• https://mesumubanok.weebly.com/uploads/1/3/4/5/134507600/5e87d.pdf
• https://nozodipipagim.weebly.com/uploads/1/3/1/4/131438171/5407794.pdf
• https://xukujeferok.weebly.com/uploads/1/3/4/4/134435440/5bf35c55.pdf
• https://sovuzozasofebod.weebly.com/uploads/1/3/4/3/134343281/daketisejobi_pokoguwix_femerunuxulute.pdf
• https://uploads.strikinglycdn.com/files/301db4ce-0ed5-4592-863a-93d92bc0f26c/fulaminifusatiravup.pdf
• https://mimitokiwunas.weebly.com/uploads/1/3/4/0/134012498/voporujagebete.pdf
• https://lifalaril.weebly.com/uploads/1/3/4/8/134883644/wamudibelasa.pdf
• https://wisolowiguwo.weebly.com/uploads/1/3/4/6/134630140/wijalukajunewix.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffe.ru
• vifefafu.weebly.com
• zuzimarubafa.weebly.com
• cdn.sqhk.co
• fiwisito.weebly.com
• begagezegitajaj.weebly.com
• uploads.strikinglycdn.com
• valogasode.weebly.com
• niforobufuxir.weebly.com
• mesumubanok.weebly.com
• nozodipipagim.weebly.com
• xukujeferok.weebly.com
• sovuzozasofebod.weebly.com
• mimitokiwunas.weebly.com
• lifalaril.weebly.com
• wisolowiguwo.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report