MALICIOUS — normal_5fdfd7242f969.pdf

MALICIOUS — normal_5fdfd7242f969.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 3926f28abd92bd35a6564cd20921c79f66065cbf753665e760cb7656197b77fa
• SHA-1: 01cc1c3f1bd4a8aa488f4994e1c75a5fb9e846b2
• MD5: 5ce9ac414ab5ecbff4d5aeac2cf68f02
• ssdeep: 1536:4SrSnFSv9AyA5lslNdEHYpVt8kEXP1dgu9rCFdiYRN7UznyaVvML4tNxmPM:3rSndxK5E2Vt8x9CusiDznyaVT/Z
• TLSH: T10437D1B36257DC8D758AA7472AB208AC348DC3C83232D6645885B67CC8787BD3F51E52
• Submitted as: normal_5fdfd7242f969.pdf
• File type: pdf · Size: 75034 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://gettraff.ru/123?utm_term=empousa+servants+of+hecate, https://kukanoli.weebly.com/uploads/1/3/4/6/134641169/gonapamexazixedexube.pdf, https://koxoganonigowup.weebly.com/uploads/1/3/1/4/131408343/2973348.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/123?utm_term=empousa+servants+of+hecate
• https://kukanoli.weebly.com/uploads/1/3/4/6/134641169/gonapamexazixedexube.pdf
• https://koxoganonigowup.weebly.com/uploads/1/3/1/4/131408343/2973348.pdf
• https://sodefabufu.weebly.com/uploads/1/3/4/4/134473286/luxubetelikeme_manopexewaju.pdf
• https://s3.amazonaws.com/xunilukegez/a_grief_observed_cs_lewis.pdf
• https://cdn-cms.f-static.net/uploads/4381104/normal_5f9f11510fc1d.pdf
• https://dumuzuvo.weebly.com/uploads/1/3/4/6/134695275/2339297.pdf
• https://s3.amazonaws.com/zozuxukoxo/witofugifobakek.pdf
• https://ribuborufexegax.weebly.com/uploads/1/3/4/5/134507127/6b28297.pdf
• https://nujetamewude.weebly.com/uploads/1/3/4/8/134881912/vamexejosebojivegivo.pdf
• https://s3.amazonaws.com/wavunot/41952263740.pdf
• https://s3.amazonaws.com/henghuili-files/lerumelet.pdf
• https://s3.amazonaws.com/zomuzigo/center_tapped_transformer_spice_model.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• kukanoli.weebly.com
• koxoganonigowup.weebly.com
• sodefabufu.weebly.com
• s3.amazonaws.com
• cdn-cms.f-static.net
• dumuzuvo.weebly.com
• ribuborufexegax.weebly.com
• nujetamewude.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report