MALICIOUS — normal_5fe1c298d1822.pdf

MALICIOUS — normal_5fe1c298d1822.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 14ffb5f64591bddd5657b688b7e4d38bddf38bbaad51ee033e3136fedeae8af5
SHA-1: d8adf803c7b1d2045eb7df53fd106a41a45f7b80
MD5: 12b719a24cf5a57dc2b61c9864da3910
ssdeep: 1536:oCe124sYVZycrWKves/6CD0zkPOa5S+oT3TZU4cQhED7Cr4n8oygrfNO2vHfsp:0I4xVZPWVa4zkJ5S3d87Ug8oygLN50p
TLSH: T11737D0F32247DD8CB7465B53A9B7616CB04E9B896932C67040D8BF6C88B827D7F00651
Submitted as: normal_5fe1c298d1822.pdf
File type: pdf · Size: 74180 bytes
Verdict: malicious (94/100)

Detections (4 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated suspicious by URL analysis: https://static1.squarespace.com/static/5fc007c924b06a7eb3fa3bc3/t/5fc16264eaf37e3b64d02211/1606509158572/84340650837.pdf - network signal, weight 0.40, confidence 0.60
Embedded network infrastructure: https://trafffi.ru/123?utm_term=shop+fox+w1685+replacement+bags, https://static1.squarespace.com/static/5fc007c924b06a7eb3fa3bc3/t/5fc16264eaf37e3b64d02211/1606509158572/84340650837.pdf, https://cdn-cms.f-static.net/uploads/4402740/normal_5f993435af272.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://trafffi.ru/123?utm_term=shop+fox+w1685+replacement+bags
https://static1.squarespace.com/static/5fc007c924b06a7eb3fa3bc3/t/5fc16264eaf37e3b64d02211/1606509158572/84340650837.pdf
https://cdn-cms.f-static.net/uploads/4402740/normal_5f993435af272.pdf
https://s3.amazonaws.com/fifomi/tony_actor_girlfriends_guide_to_divorce.pdf
https://static1.squarespace.com/static/5fc1012fe5c7695ca99c31f6/t/5fd1de24ebc7ce75e8b41717/1607589417402/zokaduvapefival.pdf
https://static1.squarespace.com/static/5fc4cb348ef7301f8b29e6b1/t/5fc8b1156031f4738625c999/1606988055823/alivio_pharmacy_berwyn.pdf
https://uploads.strikinglycdn.com/files/4d16eb6f-0873-41f3-ab84-7d8c0ccd999b/high_school_chemistry_pacing_guide.pdf
https://s3.amazonaws.com/wizidimawag/vedebemakonubobuf.pdf
https://cdn-cms.f-static.net/uploads/4375341/normal_5fbf4efe04f03.pdf
https://s3.amazonaws.com/bidivo/hashar_film_full_hd.pdf
https://s3.amazonaws.com/kuxuxemu/app_world_for_blackberry_9900.pdf
https://static1.squarespace.com/static/5fc12a0327a199023ab7046e/t/5fcaf4a07ab0f364aba314fe/1607136416495/facts_school_doesn_t_teach_you.pdf
https://uploads.strikinglycdn.com/files/c9887a65-f5c8-4f1f-93c3-3d9c8aceea71/1080.pdf
https://s3.amazonaws.com/midaguvimabof/jukak.pdf
https://rogapunuki.weebly.com/uploads/1/3/4/3/134375427/dosirarikofiput.pdf
https://cdn-cms.f-static.net/uploads/4366027/normal_5fa5ef3891efe.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

trafffi.ru
static1.squarespace.com
cdn-cms.f-static.net
s3.amazonaws.com
uploads.strikinglycdn.com
rogapunuki.weebly.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report