MALICIOUS — normal_5fecbedf9fe29.pdf

MALICIOUS — normal_5fecbedf9fe29.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 1768ee48c42a2407e4977a685f8ab88d840475771667f035701a509a2e9f2cc1
• SHA-1: 4e7e891c75fd9d65243b34ed09b793bb4889f11a
• MD5: 62a3fb01cfc2cdd4b0a70a3cf7ba9dde
• ssdeep: 1536:PT4xgRXZ3RBLasT9yShDsDaiDJ/UEQxoX5V05NbKW/BJ3jLaNCP3U6:/OwQEgDaiDlUEQxoJC5NbK0BJ3j2NCPZ
• TLSH: T15237D0F3A2ABDC4C6B8ADB87AAF6144C7105D65C2937AA1044C8777CC4746FD2E18E12
• Submitted as: normal_5fecbedf9fe29.pdf
• File type: pdf · Size: 73770 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffmen.ru/123?utm_term=henry+r+nau+perspectives+on+international+relations+pdf, https://cdn-cms.f-static.net/uploads/4391636/normal_5f94a592b58b3.pdf, https://cdn-cms.f-static.net/uploads/4369788/normal_5f882837c71fa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://traffmen.ru/123?utm_term=henry+r+nau+perspectives+on+international+relations+pdf
• https://s3.amazonaws.com/pogolo/worafuwalagijudugoboja.pdf
• https://s3.amazonaws.com/bisute/car_game_apk_3d.pdf
• https://cdn-cms.f-static.net/uploads/4391636/normal_5f94a592b58b3.pdf
• https://cdn-cms.f-static.net/uploads/4369788/normal_5f882837c71fa.pdf
• https://s3.amazonaws.com/litunux/information_blackout_meaning_in_english.pdf
• https://cdn.sqhk.co/bipobulif/2Whjs6P/indoor_waterpark_iowa_city.pdf
• https://cdn-cms.f-static.net/uploads/4422373/normal_5fb0267299c0c.pdf
• https://s3.amazonaws.com/vobuturinivi/fha_guidelines_2019_handbook.pdf
• https://uploads.strikinglycdn.com/files/471d2052-923d-457d-b6ae-c7f46bf30364/koes_plus_mp3_download.pdf
• https://s3.amazonaws.com/jasipefulaxiduj/96834719138.pdf
• https://s3.amazonaws.com/rivazixexuguri/duzomir.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffmen.ru
• s3.amazonaws.com
• cdn-cms.f-static.net
• cdn.sqhk.co
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report