MALICIOUS — normal_5fc6d6d9add03.pdf

MALICIOUS — normal_5fc6d6d9add03.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 2b837dac99fd8569d617f1b047347f7c004607d1571605a55e6e1e165272b88d
• SHA-1: 501e4e11f7cfe2cd6907fdb695c2dad8150d0531
• MD5: 4c354a14aaf9471058ea54c78246b512
• ssdeep: 1536:uZL5xUybCwWrigzoqbvvEEMnCTRY5+J14O6qy1uCYQjzJkRSolrSAoIhI8K/6:ILLmRiCbB1lGXd9BmRFxZhC8p
• TLSH: T12437CFF31257CECDBAD79B137DE62864254ED68D2022CAD41098B77C89B83BCAD10B51
• Submitted as: normal_5fc6d6d9add03.pdf
• File type: pdf · Size: 76129 bytes
• Verdict: malicious (96/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4446400/normal_5fc6cb980ad18.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: https://traffine.ru/123?utm_term=duane+lee+chapman+jr+girlfriend, https://nolaxefipox.weebly.com/uploads/1/3/4/7/134740184/8ab025.pdf, https://cdn-cms.f-static.net/uploads/4366339/normal_5fa842128c9fa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://traffine.ru/123?utm_term=duane+lee+chapman+jr+girlfriend
• https://nolaxefipox.weebly.com/uploads/1/3/4/7/134740184/8ab025.pdf
• https://cdn-cms.f-static.net/uploads/4366339/normal_5fa842128c9fa.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf58424f98375720d76b8f/1606375491641/harry_potter_pillow_pottery_barn.pdf
• https://s3.amazonaws.com/sepawi/28763114766.pdf
• https://static.s123-cdn-static.com/uploads/4446400/normal_5fc6cb980ad18.pdf
• https://cdn-cms.f-static.net/uploads/4381751/normal_5f91fd404532a.pdf
• https://cdn-cms.f-static.net/uploads/4458625/normal_5faaa69356119.pdf
• https://cdn-cms.f-static.net/uploads/4387711/normal_5fb2bb95eba33.pdf
• https://s3.amazonaws.com/vatosolikijike/catena_aurea_mark.pdf
• https://cdn-cms.f-static.net/uploads/4412415/normal_5fb47a6e1ed9d.pdf
• https://cdn-cms.f-static.net/uploads/4444884/normal_5fa4ae4d3faa4.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffine.ru
• nolaxefipox.weebly.com
• cdn-cms.f-static.net
• static1.squarespace.com
• s3.amazonaws.com
• static.s123-cdn-static.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report