MALICIOUS — normal_5fcebdb02f4ee.pdf

MALICIOUS — normal_5fcebdb02f4ee.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 07ca28b9167367aca6e1081e7cb4af563da1ee3e5b2700fc39ee5453a327d484
• SHA-1: b344829c7b537590645d1b82a71050543d542710
• MD5: a3c7a075d4184973562408a2ee137318
• ssdeep: 1536:aDHAtowVjoqhPSQDNz5LiEUb6YDE4WbC6JStJqTwo4E1TJIdKE/mT:e3SoqF5LZdgXo4E1NeKEa
• TLSH: T17238D0B35157DD8CBA819B53A9B7622C30CADB087161EDA01949763CC9E827D7F20E12
• Submitted as: normal_5fcebdb02f4ee.pdf
• File type: pdf · Size: 78391 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafftec.ru/123?utm_term=mtd+tecumseh+snow+blower+manual, https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0ee2d334513fae44668a/1606225640218/78231428544.pdf, https://cdn-cms.f-static.net/uploads/4369776/normal_5f9e6dcd32569.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://trafftec.ru/123?utm_term=mtd+tecumseh+snow+blower+manual
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0ee2d334513fae44668a/1606225640218/78231428544.pdf
• https://cdn-cms.f-static.net/uploads/4369776/normal_5f9e6dcd32569.pdf
• https://static1.squarespace.com/static/5fc1318a5bcb0228a2845bc9/t/5fcaf38426a2be7f6ddaf54e/1607136132639/extinction_burst_aba.pdf
• https://static1.squarespace.com/static/5fc5d5cf7d0c8f249d62c5dd/t/5fce20c43ff10115401a2285/1607344325463/stickers_for_laptop_free.pdf
• https://static1.squarespace.com/static/5fc6bf6a8b9e860b7b1c590b/t/5fca83b08aff060d4dd08199/1607107505368/ticket_to_earth_android_gameplay.pdf
• https://static1.squarespace.com/static/5fc5b1b8239b07229151fec3/t/5fc73ca29dfc2a40451bdff1/1606892713480/10647700554.pdf
• https://uploads.strikinglycdn.com/files/b38fbfad-d8b7-4e76-8367-911ae564a895/vuredaguvawigosufum.pdf
• https://static1.squarespace.com/static/5fc367917848ba205d2889eb/t/5fc4ca6b4e98326c02a80f0e/1606732396281/kahogo_no_kahoko_trailer.pdf
• https://s3.amazonaws.com/xarojapi/arabic_comprehension_worksheets.pdf
• https://static1.squarespace.com/static/5fc0dc532e34347c7043ce2c/t/5fc1030ceaf37e3b64bfa774/1606484749015/biochemistry_5th_edition_2019_by_satyanarayana.pdf
• https://static1.squarespace.com/static/5fc0f1dfe9fc3622d5225d5f/t/5fc2153deaf37e3b64e3cfa6/1606554941985/63236204666.pdf
• https://static1.squarespace.com/static/5fc56499e5c7695ca9b994de/t/5fceb15939a3713f5fe76f13/1607381337612/cb_insights_future_of_fintech_agenda.pdf
• https://s3.amazonaws.com/tufujifinobiro/leicester_tigers_team_sheet.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafftec.ru
• static1.squarespace.com
• cdn-cms.f-static.net
• uploads.strikinglycdn.com
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report