MALICIOUS — normal_5fce9cff20ac1.pdf

MALICIOUS — normal_5fce9cff20ac1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 1808003d6ee76d1af97fb71e432f7b8ee2998a6587b41dcf900aed39c6657a6f
• SHA-1: 15c29f4d71bef6570472c48dd4ee955ef51ca063
• MD5: bcb6a75f29578e602decd2016281d8d6
• ssdeep: 1536:S2TEqARZDVQmOoEjh/kpDsRd845xmYxPWWMmQNX68m70MmJ3yhUrS0yfiQ3WCVM1:1h+BVn5EjFRftm8PBMlNZs0Mo3yhUrem
• TLSH: T1293AC0F3619BCDDC7AC6970778F6206C358ACAC93231EED044D87A6C886D16D6D20E91
• Submitted as: normal_5fce9cff20ac1.pdf
• File type: pdf · Size: 96388 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://cctraff.ru/123?utm_term=black+clover+captains, https://static1.squarespace.com/static/5fbffa571c8c7413142c9acf/t/5fccecc57ae85b53b2928c4a/1607265477475/59439767555.pdf, https://uploads.strikinglycdn.com/files/6f9c198a-32af-4e5f-aa42-3e623f7b8086/68398812426.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://cctraff.ru/123?utm_term=black+clover+captains
• https://static1.squarespace.com/static/5fbffa571c8c7413142c9acf/t/5fccecc57ae85b53b2928c4a/1607265477475/59439767555.pdf
• https://uploads.strikinglycdn.com/files/6f9c198a-32af-4e5f-aa42-3e623f7b8086/68398812426.pdf
• https://static1.squarespace.com/static/5fc0da75085bf90c0efcd65a/t/5fc11bda9d79364840b4b814/1606491101861/66566156764.pdf
• https://uploads.strikinglycdn.com/files/f9ac1bf2-6a9b-4276-bcb7-277f06d76a23/22568438089.pdf
• https://uploads.strikinglycdn.com/files/6a924345-2a70-45bf-964a-1e63c7558c01/22968839402.pdf
• https://uploads.strikinglycdn.com/files/26447bb7-0112-47d5-b3ab-55370ef6dcee/vesawugejivazivet.pdf
• https://uploads.strikinglycdn.com/files/67673aba-5598-45be-a1a0-4dd6551110cf/63219975591.pdf
• https://waboralitenir.weebly.com/uploads/1/3/4/5/134504299/sesilubukat.pdf
• https://s3.amazonaws.com/memexelu/55274110163.pdf
• https://static1.squarespace.com/static/5fc52e78bda9c57a97da122f/t/5fcd156f8a55f2188b7db6a9/1607275888246/73752065555.pdf
• https://static1.squarespace.com/static/5fc0187aa5bc066edfa15e28/t/5fc320a0f81c9a2a0c08c702/1606623392845/46227571283.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• static1.squarespace.com
• uploads.strikinglycdn.com
• waboralitenir.weebly.com
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report