MALICIOUS — normal_5fc7d6e495372.pdf

MALICIOUS — normal_5fc7d6e495372.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 2f863841f6786c082e1c544bfa6ca638abe2d3639341d6df8b4dfe258c0f0835
• SHA-1: 2baea2497f8a8811709ff1939da81dd7521c54ad
• MD5: d70a499c66cf0e076f9d529218ba4b35
• ssdeep: 1536:CMhK/S3pNbOPjPrwv1//gBv7PBldHzV0Cq:7KEXbOrzwvh/AzBD/q
• TLSH: T15436D0F762D3DC8C66C7DB83A9B715A9614AC3587931DB9004C87A7C81AC1BE2F10E25
• Submitted as: normal_5fc7d6e495372.pdf
• File type: pdf · Size: 68970 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://gettraff.ru/123?utm_term=walk+thru+the+bible+hand+motions, https://cdn-cms.f-static.net/uploads/4384308/normal_5f9bb23195182.pdf, https://xizirogubo.weebly.com/uploads/1/3/0/7/130776043/65fd6ed8e.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/123?utm_term=walk+thru+the+bible+hand+motions
• https://cdn-cms.f-static.net/uploads/4384308/normal_5f9bb23195182.pdf
• https://xizirogubo.weebly.com/uploads/1/3/0/7/130776043/65fd6ed8e.pdf
• https://xitukuwelup.weebly.com/uploads/1/3/4/3/134340625/6391395.pdf
• https://jibisovewa.weebly.com/uploads/1/3/4/6/134653871/12f837c9625f4.pdf
• https://rexujebi.weebly.com/uploads/1/3/4/6/134688829/660615.pdf
• https://uploads.strikinglycdn.com/files/72529810-25e8-4b9a-a25d-d71d0d0e939e/betty_greys_anatomy_season_5.pdf
• https://uploads.strikinglycdn.com/files/d98f735f-21a0-48a5-a63b-768f211d3b28/fulusifinunanovixi.pdf
• https://weduparazibad.weebly.com/uploads/1/3/4/7/134710999/kuxerem-tasokamitisurit.pdf
• https://uploads.strikinglycdn.com/files/2e856d6d-c41b-4182-acf6-9bd080fcd685/80808749301.pdf
• https://valogasode.weebly.com/uploads/1/3/4/3/134320371/sewuf.pdf
• https://lubozukutiximik.weebly.com/uploads/1/3/4/4/134472848/5f0fc42.pdf
• https://ruparowix.weebly.com/uploads/1/3/4/3/134350000/9725915.pdf
• https://cdn-cms.f-static.net/uploads/4365601/normal_5f875e055d5b7.pdf
• https://tidemipevu.weebly.com/uploads/1/3/0/7/130740592/f47f5.pdf
• https://towetebofipu.weebly.com/uploads/1/3/1/4/131437669/kuwuseje-vonabodapedagaf-sudaxonu-sasipaxobesox.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• cdn-cms.f-static.net
• xizirogubo.weebly.com
• xitukuwelup.weebly.com
• jibisovewa.weebly.com
• rexujebi.weebly.com
• uploads.strikinglycdn.com
• weduparazibad.weebly.com
• valogasode.weebly.com
• lubozukutiximik.weebly.com
• ruparowix.weebly.com
• tidemipevu.weebly.com
• towetebofipu.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report