MALICIOUS — normal_5fc6087aee6b6.pdf
MALICIOUS — normal_5fc6087aee6b6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
39aabf88f6f7110e36236b95442ab43f3b78c27b13cf3051d0bb25039d3d3bda - SHA-1:
77c1346e922920b20b02b9825b10f2525b58ff0c - MD5:
25f6f0814643780c9b92ba5e20fb0129 - ssdeep:
1536:teiCmCjxDi2fVyO1QO8w59PRPPgDdo6bJwlP+FORBpBYKr:/Cmd6d1QO84rP5Qc2FOBpBJ - TLSH:
T16637D0F36193DDACB64AA7436BEB19196455C6C86832E66010C8B92CC17C7BC7F24E13 - Submitted as: normal_5fc6087aee6b6.pdf
- File type: pdf · Size: 72590 bytes
- Verdict: malicious (92/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Agent.gen
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://cctraff.ru/123?utm_term=treasure+hunting+guide, https://uploads.strikinglycdn.com/files/421f754a-3c68-4739-9367-013631429f22/70544295908.pdf, https://uploads.strikinglycdn.com/files/4c4192c4-e19d-4f6c-941d-233519225933/96665673393.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://cctraff.ru/123?utm_term=treasure+hunting+guide
- https://uploads.strikinglycdn.com/files/421f754a-3c68-4739-9367-013631429f22/70544295908.pdf
- https://s3.amazonaws.com/numunenoji/3305554852.pdf
- https://s3.amazonaws.com/pazerogasarinu/85184054931.pdf
- https://uploads.strikinglycdn.com/files/4c4192c4-e19d-4f6c-941d-233519225933/96665673393.pdf
- https://s3.amazonaws.com/kikunojulejuj/avometer_8_mk_3_manual.pdf
- https://s3.amazonaws.com/tikoweravisixu/7117348881.pdf
- https://s3.amazonaws.com/pewibim/tovunizanedokipe.pdf
- https://s3.amazonaws.com/kosipefojaw/mario_starcatcher_2_game.pdf
- https://cdn-cms.f-static.net/uploads/4423452/normal_5fbd9b6525d6b.pdf
- https://s3.amazonaws.com/juvetaso/gitazumizijeso.pdf
- https://s3.amazonaws.com/dinigugaxej/banazaxud.pdf
- https://cdn-cms.f-static.net/uploads/4387922/normal_5fb45bcddc680.pdf
- https://s3.amazonaws.com/gajabedafot/artritis_cronica_degenerativa.pdf
- https://s3.amazonaws.com/zepifudoxapo/balifumuja.pdf
- https://s3.amazonaws.com/xajowu/12737212528.pdf
- https://uploads.strikinglycdn.com/files/984faea7-563d-4daf-84fb-1f0e0e764b1a/barnes_and_noble_nook_color.pdf
- https://s3.amazonaws.com/sirilagewuga/95913649352.pdf
- https://uploads.strikinglycdn.com/files/b7b0bdb6-2599-45ba-94cf-7aa81ba73986/mobolarimaf.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- cctraff.ru
- uploads.strikinglycdn.com
- s3.amazonaws.com
- cdn-cms.f-static.net
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report