MALICIOUS — 5511116.pdf

MALICIOUS — 5511116.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 0b8a1cfede7280eab3929e17c746293fd669bd740829f92daf3f05751921ce48
• SHA-1: 6dfb99c22d262cd6b771a51a780b14b7606c39eb
• MD5: dee128b81715ee3f3cf9d9d1264d165f
• ssdeep: 1536:GRzjJyjamQSI8D6ItzIx6bnSdHf0UxTECtwvoVsfvTXtTBeX:4zMdQQo8SdMUZ/thSfrXto
• TLSH: T17C38DFF36093EDCC7B46AB032EB7156D608ED38871719E984488BA1C857E9BE7E10D11
• Submitted as: 5511116.pdf
• File type: pdf · Size: 77352 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffnew.ru/wb?keyword=soccer%20kingston%20tasmania, https://uploads.strikinglycdn.com/files/49b6be33-ac2d-4818-ae30-ceb4974ae489/kaxarenodudenatofukuganog.pdf, https://uploads.strikinglycdn.com/files/588a60fc-010b-4f4b-85ce-2495db126765/training_wheels_for_harley_davidson_motorcycles.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffnew.ru/wb?keyword=soccer%20kingston%20tasmania
• https://uploads.strikinglycdn.com/files/49b6be33-ac2d-4818-ae30-ceb4974ae489/kaxarenodudenatofukuganog.pdf
• https://uploads.strikinglycdn.com/files/588a60fc-010b-4f4b-85ce-2495db126765/training_wheels_for_harley_davidson_motorcycles.pdf
• https://waruzakelejabu.weebly.com/uploads/1/3/4/6/134600446/cefc592e1cb20.pdf
• https://s3.amazonaws.com/gonavo/fantasy_grounds_demo_mac.pdf
• https://s3.amazonaws.com/fukezavazuj/49529432697.pdf
• https://cdn.sqhk.co/tuwagezo/gehjjjc/everyday_jigsaw_puzzles_free.pdf
• https://s3.amazonaws.com/godoremitiwuja/ankle_strap_red_platform_shoes.pdf
• https://bileravufal.weebly.com/uploads/1/3/4/7/134749654/sadiga_vogeberapisenu_dobitafew.pdf
• https://s3.amazonaws.com/bidivo/6800169803.pdf
• https://s3.amazonaws.com/wufujudisu/76412659213.pdf
• https://s3.amazonaws.com/zunaporam/bokerolixo.pdf
• https://s3.amazonaws.com/gidibesuxi/financial_reporting_software_free.pdf
• https://cdn.sqhk.co/zururodi/fibbPQS/xirigasoj.pdf
• https://s3.amazonaws.com/palevijuj/hexagonal_prism_surface_area_worksheet.pdf
• https://s3.amazonaws.com/pizexopenaxu/battlefield_3_serial_key_generator.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffnew.ru
• uploads.strikinglycdn.com
• waruzakelejabu.weebly.com
• s3.amazonaws.com
• cdn.sqhk.co
• bileravufal.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report