MALICIOUS — normal_5fab00fd6d6c2.pdf

MALICIOUS — normal_5fab00fd6d6c2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 51f9698b55c285093ff7f75397dc3b09de20dc10ee9d36838e2c687e28a96d24
• SHA-1: d1642a20b54cb717be64eb5e9af3ffb1e9320db2
• MD5: a83bf0bc75be5bd3815a5049c8a38881
• ssdeep: 1536:eRlVMMW5NfrQOEnaRrutBkdFq5w1XrKE5Z/A3jNZ/O94MMmy2STirz:SlVMRaOEnaEtBGFqUrKRq9GmyrTm
• TLSH: T15636D0F3606BCD8CBB4A7F437DEB001D3489E2CA61328A522088756DC8782FD6E11D51
• Submitted as: normal_5fab00fd6d6c2.pdf
• File type: pdf · Size: 67186 bytes
• Verdict: malicious (94/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://foroziroxodom.weebly.com/uploads/1/3/4/6/134647192/607a707d7a06.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://trafficel.ru/123?keyword=3d+ripper+dx, https://sigozebuxofiko.weebly.com/uploads/1/3/4/3/134372047/4281638.pdf, https://buxiniti.weebly.com/uploads/1/3/4/3/134309366/8432590.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafficel.ru/123?keyword=3d+ripper+dx
• https://s3.amazonaws.com/jubiferekaka/gofukusek.pdf
• https://sigozebuxofiko.weebly.com/uploads/1/3/4/3/134372047/4281638.pdf
• https://s3.amazonaws.com/roware/twitchcon_dates_2020.pdf
• https://s3.amazonaws.com/pegek/xarojizul.pdf
• https://buxiniti.weebly.com/uploads/1/3/4/3/134309366/8432590.pdf
• https://s3.amazonaws.com/vabedafozo/zojilawigijetilaxoveza.pdf
• https://uploads.strikinglycdn.com/files/1b9e3545-7ab9-4b8a-8414-2ecfe88f86ed/76485200199.pdf
• https://foroziroxodom.weebly.com/uploads/1/3/4/6/134647192/607a707d7a06.pdf
• https://mitixofixomu.weebly.com/uploads/1/3/4/3/134333727/7403542.pdf
• https://uploads.strikinglycdn.com/files/3369214a-e5aa-4cf7-96a1-34345acd7e0f/wekexagenonavaxopidejus.pdf
• https://s3.amazonaws.com/fukezavazuj/super_mario_3d_land_download_file.pdf
• https://uploads.strikinglycdn.com/files/3e7d8d95-c65c-47e4-bdf3-b7d3804de6e3/jamedexutasapepafisa.pdf
• https://sububavujowiv.weebly.com/uploads/1/3/4/4/134460245/7732505.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafficel.ru
• s3.amazonaws.com
• sigozebuxofiko.weebly.com
• buxiniti.weebly.com
• uploads.strikinglycdn.com
• foroziroxodom.weebly.com
• mitixofixomu.weebly.com
• sububavujowiv.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report