MALICIOUS — normal_5fd8cf6c94c32.pdf

MALICIOUS — normal_5fd8cf6c94c32.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 07234c1c76c8005998ce3cdc3f4ad38fdf285630a8b4dd8fc976b8b48a82dbe1
• SHA-1: 298317e711e0dd0e34e47308ccae2f2c5d3a3f3b
• MD5: 533479c34c02f99c8640abcf6a3b2f78
• ssdeep: 1536:ufPTUFL54VwqE1NWHfdiQcT4SLY/SaAekQKU1dYbrX:IbU8wH4/rRGE1kQKUvE
• TLSH: T1A435CFF36253DF8E678A27837AB5269D7097D68C7136865904C87B2CC9782AD3F20D40
• Submitted as: normal_5fd8cf6c94c32.pdf
• File type: pdf · Size: 59104 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafffi.ru/123?utm_term=cuando+yo+era+ni%25C3%25B1o+nunca, https://depatimuxuzox.weebly.com/uploads/1/3/4/4/134404048/109285.pdf, https://vunubudewodazuz.weebly.com/uploads/1/3/4/3/134340329/sowupafe_situwilid.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://trafffi.ru/123?utm_term=cuando+yo+era+ni%25C3%25B1o+nunca
• https://depatimuxuzox.weebly.com/uploads/1/3/4/4/134404048/109285.pdf
• https://vunubudewodazuz.weebly.com/uploads/1/3/4/3/134340329/sowupafe_situwilid.pdf
• https://turonobofudub.weebly.com/uploads/1/3/4/4/134463989/ad82193e60565f.pdf
• https://nigafabap.weebly.com/uploads/1/3/4/3/134377596/jukivo.pdf
• https://xodalolekuxol.weebly.com/uploads/1/3/4/1/134108590/7825d95e0431b.pdf
• https://ruwalabipuges.weebly.com/uploads/1/3/4/4/134465281/1031374.pdf
• https://cdn-cms.f-static.net/uploads/4421460/normal_5fa1adabef6fc.pdf
• https://wezogefizu.weebly.com/uploads/1/3/4/2/134234847/togem.pdf
• https://static1.squarespace.com/static/5fc13debbd14ff0dd29efe80/t/5fce7b668a454103bf7703d0/1607367529036/cbse_class_9_syllabus_half_yearly.pdf
• https://static1.squarespace.com/static/5fc19ab11452f90b7fea4d21/t/5fc2c1e6e18c5c478e5658f2/1606599142806/35348448589.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffi.ru
• depatimuxuzox.weebly.com
• vunubudewodazuz.weebly.com
• turonobofudub.weebly.com
• nigafabap.weebly.com
• xodalolekuxol.weebly.com
• ruwalabipuges.weebly.com
• cdn-cms.f-static.net
• wezogefizu.weebly.com
• static1.squarespace.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report