MALICIOUS — normal_5fb982cfa4616.pdf

MALICIOUS — normal_5fb982cfa4616.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 42b7679ec51937c846e4f26be70d6f1adbdadaa898527239433c30084fdcff5c
• SHA-1: b841337eb1bdd545cd71800938c6739b9ddb6829
• MD5: fdf7e199442d54ae6dcaefe6b6e6522e
• ssdeep: 1536:MJprw6s4HGXnI4aEAPB9ZBPL2cR4OqtdwiyIgVjZUdAjVdZqdb7IP:ks6s4m3Iv1J16cSHtfpUj2dAjVvGbg
• TLSH: T15A38E0F36187DE5C6F869B037AA62259B0C9D2882423F75020CE776CD6B42FE5E10B50
• Submitted as: normal_5fb982cfa4616.pdf
• File type: pdf · Size: 82010 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafffi.ru/123?utm_term=nes+manual+dimensions, https://uploads.strikinglycdn.com/files/cee8b966-393c-40a9-8cfb-65a762d246e7/36221426374.pdf, https://uploads.strikinglycdn.com/files/1f89c7f2-77f2-40f8-b898-9c1ddb022f5a/35604800561.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafffi.ru/123?utm_term=nes+manual+dimensions
• https://s3.amazonaws.com/degagaziv/221554484.pdf
• https://uploads.strikinglycdn.com/files/cee8b966-393c-40a9-8cfb-65a762d246e7/36221426374.pdf
• https://uploads.strikinglycdn.com/files/1f89c7f2-77f2-40f8-b898-9c1ddb022f5a/35604800561.pdf
• https://fetazudumaveber.weebly.com/uploads/1/3/4/6/134615608/3957451.pdf
• https://s3.amazonaws.com/nuxepiduded/goxorevo.pdf
• https://uploads.strikinglycdn.com/files/b9f19eca-97a8-418f-a686-e85e5e4adede/ball_of_wool_osrs.pdf
• https://uploads.strikinglycdn.com/files/78227543-9dc1-4118-9913-227d0945e4d4/98821740692.pdf
• https://uploads.strikinglycdn.com/files/b12a526a-950d-4572-8016-b83bf91d520d/mean_girls_stereotypes.pdf
• https://s3.amazonaws.com/tokatefozude/bishops_stortford_college_uniform_list.pdf
• https://s3.amazonaws.com/takateg/xplore_file_manager_mod_apk.pdf
• https://s3.amazonaws.com/xakapudakadu/aces_high_guitar_tab.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffi.ru
• s3.amazonaws.com
• uploads.strikinglycdn.com
• fetazudumaveber.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report