MALICIOUS — daenerys_fan_art.pdf

MALICIOUS — daenerys_fan_art.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 4155373539352e7595aa96a142ac70549db80b909e3901e125d70504ceeefd7c
• SHA-1: 738496c0481d5adf1e0b3a2b98c63ef9b058a672
• MD5: 41b7725aeb39b23c2c05550ded7a9b40
• ssdeep: 1536:a2ppxZnVt4Gn4BBjqOnEOslTzdyhhR6TnJ4QmALS:aSVtTwBmiEOslTZchMTJml
• TLSH: T18336D0F37197CC88B6876B577E7E042C708D97846632EFE04488762DC4789BD2EA4A11
• Submitted as: daenerys_fan_art.pdf
• File type: pdf · Size: 66883 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffset.ru/strik?utm_term=daenerys+fan+art, https://uploads.strikinglycdn.com/files/cf3aa97d-ce3c-4ecd-9d00-b1bd24533b61/summertime_saga_download_ios.pdf, https://cdn-cms.f-static.net/uploads/4368478/normal_5f8fe621b87a7.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffset.ru/strik?utm_term=daenerys+fan+art
• https://uploads.strikinglycdn.com/files/cf3aa97d-ce3c-4ecd-9d00-b1bd24533b61/summertime_saga_download_ios.pdf
• https://cdn-cms.f-static.net/uploads/4368478/normal_5f8fe621b87a7.pdf
• https://uploads.strikinglycdn.com/files/8b583746-9d99-40b9-9bdf-5bf80102daae/40664185013.pdf
• https://cdn-cms.f-static.net/uploads/4403557/normal_5fa751bf13b0f.pdf
• https://cdn-cms.f-static.net/uploads/4386080/normal_5f9dc67e972c6.pdf
• https://cdn-cms.f-static.net/uploads/4384649/normal_5fbb21c1941b9.pdf
• https://uploads.strikinglycdn.com/files/25df5840-2fd3-443e-ad92-af52e4b90e66/85806109308.pdf
• https://cdn-cms.f-static.net/uploads/4496404/normal_5fba434cb1dcf.pdf
• https://s3.amazonaws.com/zidenigad/75787524212.pdf
• https://cdn-cms.f-static.net/uploads/4470228/normal_5fa6d4251bc10.pdf
• https://s3.amazonaws.com/bisute/ronuluxizuza.pdf
• https://cdn-cms.f-static.net/uploads/4388177/normal_5f91b0d790078.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffset.ru
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report