MALICIOUS — normal_5fa9cbce52261.pdf

MALICIOUS — normal_5fa9cbce52261.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 3327956a1899150338927fb7095611ed577cad7365549d0cf49f18781700ce88
• SHA-1: bfb66515480f5f5fe52b757eda07475e0ab51790
• MD5: f1717116226934f84ea6f66057d5645d
• ssdeep: 1536:oOthL8Q83TQp0MK733LOECQVzjuGX5qLttX1A:xy0+7HqECQVL5qXS
• TLSH: T1E636D0F37157CE8C698A7B039EBB146855CDC64D5132AB210488BA2CC9786FDBFB0521
• Submitted as: normal_5fa9cbce52261.pdf
• File type: pdf · Size: 67913 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffine.ru/123?keyword=davenport+florida+to+disney+directions, https://uploads.strikinglycdn.com/files/75dd1bdd-216b-4524-9b7c-ad736d61ef68/le_dejeuner_des_loups.pdf, https://uploads.strikinglycdn.com/files/30751853-6473-4fb5-b740-fe0c61b66e21/nest_thermostat_monthly_fee.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffine.ru/123?keyword=davenport+florida+to+disney+directions
• https://uploads.strikinglycdn.com/files/75dd1bdd-216b-4524-9b7c-ad736d61ef68/le_dejeuner_des_loups.pdf
• https://s3.amazonaws.com/mijedusovineti/vozaguwi.pdf
• https://s3.amazonaws.com/vavebufevodutob/ttd_calendar_2018_free_download.pdf
• https://uploads.strikinglycdn.com/files/30751853-6473-4fb5-b740-fe0c61b66e21/nest_thermostat_monthly_fee.pdf
• https://s3.amazonaws.com/gozilum/kisedabaz.pdf
• https://s3.amazonaws.com/zetare/manual_para_aprender_ingles_para_nios.pdf
• https://s3.amazonaws.com/jitimesolagun/bezemused.pdf
• https://uploads.strikinglycdn.com/files/675af457-8f62-4cc6-8e57-357d9a151a96/u_visa_personal_statement_sample.pdf
• https://s3.amazonaws.com/fifomi/unblocked_games_6969_strike_force_heroes_3.pdf
• https://uploads.strikinglycdn.com/files/c4c0a5d8-d4a8-44cf-9832-04b9da7acf55/58146236318.pdf
• https://s3.amazonaws.com/sirilagewuga/lirunar.pdf
• https://fulojozizarotuv.weebly.com/uploads/1/3/4/3/134318677/18c100.pdf
• https://lukafitujukeme.weebly.com/uploads/1/3/3/9/133997152/jopubuzujumel.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffine.ru
• uploads.strikinglycdn.com
• s3.amazonaws.com
• fulojozizarotuv.weebly.com
• lukafitujukeme.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report