MALICIOUS — normal_5fc3fb644e7f2.pdf

MALICIOUS — normal_5fc3fb644e7f2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 2444bb36bed68238aa246cc6ea804b7d804f112aa6c62d6edc7a9f15a8d77fd0
• SHA-1: 69c7f81dfdc26c4eb20bcd0f401ee7d93f51e0af
• MD5: 1abd8ee56d2c5bbd7784450d3fb04729
• ssdeep: 3072:Z8Kd1k/hYR/yVLnB4+QHRMut0A5GDq++ldnm:7duJRVLnBpyT0TPZ
• TLSH: T19A3CF2F30267EDCD7789BF276AB61128588ACA087162C76910C4B97CC6387BEED10951
• Submitted as: normal_5fc3fb644e7f2.pdf
• File type: pdf · Size: 122475 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafftec.ru/123?utm_term=chart+of+accounts+pdf+pakistan, https://nirawulef.weebly.com/uploads/1/3/4/3/134324477/wefiwupo.pdf, https://woxujinugav.weebly.com/uploads/1/3/4/3/134305359/ruzep.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafftec.ru/123?utm_term=chart+of+accounts+pdf+pakistan
• https://s3.amazonaws.com/wonoti/branches_of_government_graphic_organizer.pdf
• https://s3.amazonaws.com/lanubili/financial_statement_ratio_analysis_spreadsheet.pdf
• https://nirawulef.weebly.com/uploads/1/3/4/3/134324477/wefiwupo.pdf
• https://woxujinugav.weebly.com/uploads/1/3/4/3/134305359/ruzep.pdf
• https://sebonegipuwi.weebly.com/uploads/1/3/4/1/134108682/7311382.pdf
• https://cdn-cms.f-static.net/uploads/4375073/normal_5fa6df2da2984.pdf
• https://s3.amazonaws.com/miledu/thank_you_for_your_patience_email_template.pdf
• https://bubixoduxufito.weebly.com/uploads/1/3/1/0/131070588/pevigabimine.pdf
• https://s3.amazonaws.com/tadovu/jigijorunidixe.pdf
• https://uploads.strikinglycdn.com/files/e9fc978d-8053-4152-b73e-ed98d2e1635b/34495694455.pdf
• https://s3.amazonaws.com/sirilagewuga/95066149795.pdf
• https://cdn-cms.f-static.net/uploads/4375200/normal_5f8f13965b139.pdf
• https://s3.amazonaws.com/jubiferekaka/32081835286.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafftec.ru
• s3.amazonaws.com
• nirawulef.weebly.com
• woxujinugav.weebly.com
• sebonegipuwi.weebly.com
• cdn-cms.f-static.net
• bubixoduxufito.weebly.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report