MALICIOUS — normal_5fc5f44c6c37c.pdf

MALICIOUS — normal_5fc5f44c6c37c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 51ac1ea899b982dbe059aae19d8ba6a8443dc3fbd8968a537b162c8abe913a90
• SHA-1: 76d363c7352ce590812c28072c6008b8c62680ea
• MD5: 03311ccb60da79c499ab2e2b2a252f6d
• ssdeep: 1536:VhD0zz1wsp62Cd/OmKGxBEMdzhQqY+99cospOefc07033n03vZksgV:szzW3PdFKGxBEMMGHj2XU0iX0Rkf
• TLSH: T17D38E1F372C7DD9C3B4AAB47FAE5812C2446D6883161DA6108C8B62DC4AC2FC7E40E51
• Submitted as: normal_5fc5f44c6c37c.pdf
• File type: pdf · Size: 78090 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffmen.ru/123?utm_term=tea+for+dummies+pdf, https://uploads.strikinglycdn.com/files/8f293abf-d885-4325-9ac7-9c9275bb2c3f/64315711856.pdf, https://basexexax.weebly.com/uploads/1/3/4/3/134308464/bubomujutafa.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://traffmen.ru/123?utm_term=tea+for+dummies+pdf
• https://uploads.strikinglycdn.com/files/8f293abf-d885-4325-9ac7-9c9275bb2c3f/64315711856.pdf
• https://basexexax.weebly.com/uploads/1/3/4/3/134308464/bubomujutafa.pdf
• https://uploads.strikinglycdn.com/files/8db6fcb2-c095-47a1-bad4-3fe35d5dd651/nelifi.pdf
• https://letitunonagafi.weebly.com/uploads/1/3/4/4/134494227/3440429.pdf
• https://uploads.strikinglycdn.com/files/d36eb410-e795-4882-9329-943ef146ba58/determine_the_indices_for_the_directions_shown_in_the_following_cubic_unit_cell.pdf
• https://uploads.strikinglycdn.com/files/f030c943-c2a3-4936-93a6-3f3b6a283c03/didudesexoditiga.pdf
• https://s3.amazonaws.com/tezude/68407678518.pdf
• https://sixexarujizevav.weebly.com/uploads/1/3/4/5/134584368/3ad1a5b42fe8.pdf
• https://uploads.strikinglycdn.com/files/c79b1c39-a44f-4a22-9205-91a2f230bbc1/caserne_pompier_melun.pdf
• https://xixunogada.weebly.com/uploads/1/3/4/3/134343035/3767887.pdf
• https://litukepulaj.weebly.com/uploads/1/3/4/8/134863372/zenejelopafarozi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffmen.ru
• uploads.strikinglycdn.com
• basexexax.weebly.com
• letitunonagafi.weebly.com
• s3.amazonaws.com
• sixexarujizevav.weebly.com
• xixunogada.weebly.com
• litukepulaj.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report