MALICIOUS — normal_5fbab5473629c.pdf

MALICIOUS — normal_5fbab5473629c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 4d18bf411b4bd41ad2102cb9178c91d52473add8b5aa7fd368ba3fbdb4527fc2
• SHA-1: 73b34910b42936feda77f0ab8c26e9e7b71667c6
• MD5: 96c54091bde69bee2956ee207ce3ce73
• ssdeep: 6144:qkc2RlMt3aJzz3j5lOvSK/JWE887OyfXsZwVPyVXQaa:qktRatKJL5OBFtEZwZvP
• TLSH: T11D4622F36167EC4C73D1A31B68ADA0685124A64D6127FF9108C9BBEDC06C73D2B98784
• Submitted as: normal_5fbab5473629c.pdf
• File type: pdf · Size: 315590 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafftec.ru/123?utm_term=dating+an+alcoholic+girlfriend, https://cdn-cms.f-static.net/uploads/4469645/normal_5fa82f385b94d.pdf, https://cdn-cms.f-static.net/uploads/4373301/normal_5f8ce62fb77ef.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://trafftec.ru/123?utm_term=dating+an+alcoholic+girlfriend
• https://cdn-cms.f-static.net/uploads/4469645/normal_5fa82f385b94d.pdf
• https://cdn-cms.f-static.net/uploads/4373301/normal_5f8ce62fb77ef.pdf
• https://cdn-cms.f-static.net/uploads/4417983/normal_5fa59d0e930e7.pdf
• https://s3.amazonaws.com/lixuzo/53942107649.pdf
• https://s3.amazonaws.com/vovabagubajegeb/48510279360.pdf
• https://cdn-cms.f-static.net/uploads/4495037/normal_5fab70521f19a.pdf
• https://cdn-cms.f-static.net/uploads/4393763/normal_5f90a1fcd5035.pdf
• https://cdn-cms.f-static.net/uploads/4446152/normal_5fad92d201197.pdf
• https://titenukom.weebly.com/uploads/1/3/4/5/134523185/mutapor.pdf
• https://wepugimi.weebly.com/uploads/1/3/1/0/131070973/xowirokagejewu_xorikuno_tidipawane_xorisomeni.pdf
• https://ruwadegefanum.weebly.com/uploads/1/3/4/1/134108857/pivedopu_majidigo_jiwiwop_remepobifute.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafftec.ru
• cdn-cms.f-static.net
• s3.amazonaws.com
• titenukom.weebly.com
• wepugimi.weebly.com
• ruwadegefanum.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

File paths

• I:\sII

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report