MALICIOUS — normal_5fada0e476174.pdf

MALICIOUS — normal_5fada0e476174.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 0554aeff95cf1f8de7812476c86a060767d2a41634a7519c4c79357879104264
• SHA-1: 5b8ebe3aede26545f702cd79f8febccc16d23b95
• MD5: f24690279e1b565b30beb611aa6f0436
• ssdeep: 1536:BrqI3R4QmjrR6SpqS023Mxvh0E8hl6N4jYo0f5RO8tg+5etB:hV3+rRRpOxvhJsqjnf5RO8tg7
• TLSH: T1FF36D0F3555BCE8C7799AF036AAF202EB09AC398A433C1545488B52CC57C7FD6E08661
• Submitted as: normal_5fada0e476174.pdf
• File type: pdf · Size: 69422 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffmen.ru/123?utm_term=navy+cfl+eval+bullets, https://uploads.strikinglycdn.com/files/1dfe398d-e0f0-4b81-8fb7-71c770266d84/50486135649.pdf, https://cdn-cms.f-static.net/uploads/4372721/normal_5f8e7ed23512c.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://traffmen.ru/123?utm_term=navy+cfl+eval+bullets
• https://uploads.strikinglycdn.com/files/1dfe398d-e0f0-4b81-8fb7-71c770266d84/50486135649.pdf
• https://cdn-cms.f-static.net/uploads/4372721/normal_5f8e7ed23512c.pdf
• https://s3.amazonaws.com/tenunud/23595116142.pdf
• https://s3.amazonaws.com/satudifin/stack_on_step_n_store_tool_box_ssr-20.pdf
• https://s3.amazonaws.com/fekaduvopigab/rfk_middle_school.pdf
• https://cdn-cms.f-static.net/uploads/4413713/normal_5fac0bd667475.pdf
• https://s3.amazonaws.com/juzowilipi/realidades_1_workbook.pdf
• https://cdn-cms.f-static.net/uploads/4408707/normal_5fad6bc1a2d04.pdf
• https://s3.amazonaws.com/bepukuba/epidemiologist_starting_salary_2019.pdf
• https://uploads.strikinglycdn.com/files/94652cfa-01b5-433b-bca1-c06b81dc9ab4/31706381566.pdf
• https://uploads.strikinglycdn.com/files/ff9429fa-db0a-46d3-95da-99a5bab56058/farmacologia_libros_gratis.pdf
• https://s3.amazonaws.com/waxapoz/adobe_photoshop_cs4_serial_number_generator.pdf
• https://uploads.strikinglycdn.com/files/250cfcca-352b-4be6-a352-0d62ca117155/vizizulobudodumanezewo.pdf
• https://cdn-cms.f-static.net/uploads/4381094/normal_5f9e59b35b979.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffmen.ru
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report