MALICIOUS — normal_5fafab645287d.pdf

MALICIOUS — normal_5fafab645287d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 43600f2bd3e7b35ded3b846b29d785613522549958831cae20ffc1ef476013e1
• SHA-1: 883caf1921d234221ffe32e4ed127852c8f4c31d
• MD5: 45c3f44c243982ecb844dd76d70a4f1c
• ssdeep: 1536:oqqgVl68UrWyb3bW/1h/Cri0TWLo1FIKETDAr48C1AXjqFnshUWVh9hvgrK0O:j5Mxz3M1sri0P1+HTsek2FnghLhvgrS
• TLSH: T1BC38CFF362ABDD8C7B879F436AF2105C749BC2982531969014586BACC4B89FE7F20D11
• Submitted as: normal_5fafab645287d.pdf
• File type: pdf · Size: 77063 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffking.ru/123?utm_term=subdural+vs+epidural+hematoma+spine, https://livekurot.weebly.com/uploads/1/3/4/4/134443702/fad7db9a0620ab9.pdf, https://uploads.strikinglycdn.com/files/8bef6930-84cf-42ef-adfe-98952358d808/secrets_of_grindea_mods.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://traffking.ru/123?utm_term=subdural+vs+epidural+hematoma+spine
• https://s3.amazonaws.com/xatojem/lelezivusavokifowujas.pdf
• https://livekurot.weebly.com/uploads/1/3/4/4/134443702/fad7db9a0620ab9.pdf
• https://uploads.strikinglycdn.com/files/8bef6930-84cf-42ef-adfe-98952358d808/secrets_of_grindea_mods.pdf
• https://uploads.strikinglycdn.com/files/e1d3ea20-c031-43d9-a3ae-eb60d5f78ff8/self_authorship_program_jordan_peterson.pdf
• https://s3.amazonaws.com/votawawo/luvuwetirozadovadiz.pdf
• https://s3.amazonaws.com/tetofamuxulil/lehninger_biochemistry_2017.pdf
• https://s3.amazonaws.com/muvazi/delta_flights_reservations_multi_city.pdf
• https://s3.amazonaws.com/fefurorobumi/xonoduvep.pdf
• https://s3.amazonaws.com/tuxutedi/agreement_on_trade_in_civil_aircraft.pdf
• https://s3.amazonaws.com/biwuwukesazef/ridgewood_elementary_school_portland.pdf
• https://s3.amazonaws.com/moxekibupuru/property_profile_inc_nv.pdf
• https://s3.amazonaws.com/retisovojor/i_ching_free_download.pdf
• https://s3.amazonaws.com/tifuwuw/kinunosipod.pdf
• https://uploads.strikinglycdn.com/files/8cd9454b-6f34-4f63-b641-4e7cf085e19f/59367363572.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffking.ru
• s3.amazonaws.com
• livekurot.weebly.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report