MALICIOUS — normal_5fce6d1171487.pdf

MALICIOUS — normal_5fce6d1171487.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 3765bb4210188806806aa25f0b1b643747a1994000c06c20aef7042ff01e7f0c
• SHA-1: 87bd85a2492eab822df8ae939b5604a891f60b95
• MD5: 9274dbaeaa7e9157f8a19d0b6bd7dbf2
• ssdeep: 1536:Sw+jz2S/jViVoeOEq4KsvoUGgQvBaWg6KKKBa0YMH5IwtmzNojfPI:h+5jsVoYfKOoUGgQvLg8KBaMCwtmzNo8
• TLSH: T11C37D0F3B2DBDD8CBE566F1718F004687409E7CC7176AAA044D97A6C81A42FC6E10D51
• Submitted as: normal_5fce6d1171487.pdf
• File type: pdf · Size: 72036 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffking.ru/123?utm_term=access+to+health+13th+edition, https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd29b1e1f2823a1204df9c/1606232498213/1979_d_penny_varieties.pdf, https://uploads.strikinglycdn.com/files/f4ab9cf2-9651-4371-b33d-54e4de142a4d/12989362669.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffking.ru/123?utm_term=access+to+health+13th+edition
• https://s3.amazonaws.com/vososasoxumete/lufobasaz.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd29b1e1f2823a1204df9c/1606232498213/1979_d_penny_varieties.pdf
• https://uploads.strikinglycdn.com/files/f4ab9cf2-9651-4371-b33d-54e4de142a4d/12989362669.pdf
• https://static1.squarespace.com/static/5fc4c05eb8467722f1ec93c2/t/5fce14eb3ff101154018e285/1607341291879/77426551006.pdf
• https://s3.amazonaws.com/mijedusovineti/biodata_format_in_word_for_marriage.pdf
• https://cdn-cms.f-static.net/uploads/4501028/normal_5fb547e4e9b32.pdf
• https://uploads.strikinglycdn.com/files/663b9bcf-2449-41c0-a230-67f6ef8c3af3/58002443968.pdf
• https://uploads.strikinglycdn.com/files/3e5396bd-83a4-476d-8f04-5b0aaa91d937/30089069044.pdf
• https://uploads.strikinglycdn.com/files/7ec53555-7a9e-42ba-998c-934a43d443e5/468049097.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffking.ru
• s3.amazonaws.com
• static1.squarespace.com
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report