MALICIOUS — 4421467.pdf

MALICIOUS — 4421467.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 39488610ee4625e67f83f8b1723eecfc2105416387f9392ce9a135ce1e25f220
• SHA-1: b0d09dbc42bd3c5291cbaaa91be112fd036ae756
• MD5: ca86d50b2b22575e6258fed4c2f264a6
• ssdeep: 1536:dOP7rPTRkoosdQUByWs3hgPGTqutQbVRnr/EI7i/MwMxYzQHa:e7rT1AKyLhgQxtQzr/EI7i0wkYzX
• TLSH: T18F37BFF761BBCC8CABDBAB4399A3145D788AC64C3056976084C8F65CD5BC7AD2F10A10
• Submitted as: 4421467.pdf
• File type: pdf · Size: 72652 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://gettraff.ru/wb?keyword=2017%20eic%20worksheet%20for%201040ez, https://cdn-cms.f-static.net/uploads/4390661/normal_5f978b5b6fb7c.pdf, https://uploads.strikinglycdn.com/files/6dc78194-4843-4fb6-9d07-6131af9eb893/15004533220.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/wb?keyword=2017%20eic%20worksheet%20for%201040ez
• https://cdn-cms.f-static.net/uploads/4390661/normal_5f978b5b6fb7c.pdf
• https://uploads.strikinglycdn.com/files/6dc78194-4843-4fb6-9d07-6131af9eb893/15004533220.pdf
• https://uploads.strikinglycdn.com/files/0a6c195a-7a22-44df-872d-9f2f63e94fda/41162543173.pdf
• https://cdn-cms.f-static.net/uploads/4375076/normal_5f89e09d389be.pdf
• https://cdn-cms.f-static.net/uploads/4420604/normal_5fa22db2b1704.pdf
• https://uploads.strikinglycdn.com/files/370b53c8-779b-4db0-b582-e31e99f4eb37/87840873082.pdf
• https://xawazexeresav.weebly.com/uploads/1/3/4/5/134527443/7df0bbd192a33.pdf
• https://cdn-cms.f-static.net/uploads/4370059/normal_5f9530f4e6f04.pdf
• https://babikovinemixe.weebly.com/uploads/1/3/1/8/131856339/5e5578ae4370d.pdf
• https://vatipasa.weebly.com/uploads/1/3/0/7/130775610/lojaga-lopuxez-ralasotazet-dazilekem.pdf
• https://uploads.strikinglycdn.com/files/3db1e15f-8011-4dd8-8c6b-94e7bab4576d/volesitabopamenanuv.pdf
• https://cdn-cms.f-static.net/uploads/4369143/normal_5f907c294cdd3.pdf
• https://cdn-cms.f-static.net/uploads/4411491/normal_5fa359c284058.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• cdn-cms.f-static.net
• uploads.strikinglycdn.com
• xawazexeresav.weebly.com
• babikovinemixe.weebly.com
• vatipasa.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report