MALICIOUS — normal_5fc70fe6495f5.pdf

MALICIOUS — normal_5fc70fe6495f5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 3c76b194aa3023de6893acae40308dda71962a69c093f29da2150777556299d5
• SHA-1: 1c4298c1a2aba1a5f7a506186319c7e03ef74daa
• MD5: c6fac205cc4bb90e9905bb1794d297d5
• ssdeep: 1536:2He/S6RW9u6wNnchFjPEONIylqOOR/nZr5TXumDDAE:ce6jMGhxPlpMZr5TXuQf
• TLSH: T16735D1F35157DD8C63AA8B03BEE6186D7199C78C1131D7A89800BA7CD8746ED7E20B50
• Submitted as: normal_5fc70fe6495f5.pdf
• File type: pdf · Size: 59638 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://gettraff.ru/123?utm_term=jesse+and+mike+funny+videos, https://uploads.strikinglycdn.com/files/bc289324-9530-4ff2-a530-38c8bc3abf7d/konegobenejozuno.pdf, https://sinepakeje.weebly.com/uploads/1/3/4/4/134490574/58f70df8.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/123?utm_term=jesse+and+mike+funny+videos
• https://uploads.strikinglycdn.com/files/bc289324-9530-4ff2-a530-38c8bc3abf7d/konegobenejozuno.pdf
• https://sinepakeje.weebly.com/uploads/1/3/4/4/134490574/58f70df8.pdf
• https://s3.amazonaws.com/fajujiju/neviwisurodobu.pdf
• https://s3.amazonaws.com/radubozufiwo/india_independence_day_quiz_with_answers.pdf
• https://static1.squarespace.com/static/5fc4dac4ec917750a3f10bd2/t/5fc70597b2fa4660c8c98f5f/1606878615883/libibugepodeloxezupisi.pdf
• https://static1.squarespace.com/static/5fbffe61bf71053ccb0b2b06/t/5fc11a54f3de5e49b58b8433/1606490709352/45119590483.pdf
• https://polabufasol.weebly.com/uploads/1/3/2/8/132814050/gojirimezan_bijixoxer_pusuju_momadinidomoji.pdf
• https://bubiwodepu.weebly.com/uploads/1/3/2/8/132815961/f2d7f45.pdf
• https://static1.squarespace.com/static/5fc65600f9866f3fd2f8cf86/t/5fc70b51a907d7439cd148c5/1606880082065/download_music_mp3_files_free.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• uploads.strikinglycdn.com
• sinepakeje.weebly.com
• s3.amazonaws.com
• static1.squarespace.com
• polabufasol.weebly.com
• bubiwodepu.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report