MALICIOUS — worlds_fattest_cat_2019.pdf

MALICIOUS — worlds_fattest_cat_2019.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 52d800e97a992207aba215fc10c0d8edb856f2722742fd8b9e6db5c4f7c57b30
• SHA-1: 6f8e05a4ae29220b613fb3b6eccb5729817b0051
• MD5: c037914c89657e85767776f8daa8711d
• ssdeep: 1536:EFFX+O4biYMnzzQFRp2VEB5swbRhYrtRjpjKMiE/dIeBt/j4W92qMzkbP:AFXTcukkneRhmj05eNSi
• TLSH: T15A37E1F352E3DCDC5A619B13BDFE1478A151E6846036CA30464C7A2C89F87BE3E51921
• Submitted as: worlds_fattest_cat_2019.pdf
• File type: pdf · Size: 74517 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffnew.ru/strik?utm_term=worlds+fattest+cat+2019, https://goduvozimaku.weebly.com/uploads/1/3/1/3/131380582/4688974.pdf, https://wojedebaroz.weebly.com/uploads/1/3/1/6/131637691/siwelajazi-doteravumap.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://traffnew.ru/strik?utm_term=worlds+fattest+cat+2019
• https://s3.amazonaws.com/sirasu/polystyrene_uses_ppt.pdf
• https://goduvozimaku.weebly.com/uploads/1/3/1/3/131380582/4688974.pdf
• https://wojedebaroz.weebly.com/uploads/1/3/1/6/131637691/siwelajazi-doteravumap.pdf
• https://raralulewuk.weebly.com/uploads/1/3/4/4/134478892/patuxajo.pdf
• https://uploads.strikinglycdn.com/files/8f205845-a6d3-4e72-8a7c-9bcefaea2d7a/76158147510.pdf
• https://uploads.strikinglycdn.com/files/9f80aa84-a4db-4916-bf79-c8109a37c26c/xibevilogife.pdf
• https://uploads.strikinglycdn.com/files/fb36078e-9c21-4b7c-8d8b-bf98301bb4c8/probability_and_statistics_for_engineering_and_the_sciences_solutions.pdf
• https://kuzaloxamuw.weebly.com/uploads/1/3/1/4/131406684/wawukujebitit.pdf
• https://s3.amazonaws.com/jenisozazewubo/c._v_maker_apk.pdf
• https://cdn-cms.f-static.net/uploads/4368955/normal_5fabf9fcd1891.pdf
• https://cdn-cms.f-static.net/uploads/4370059/normal_5f9213caae9c1.pdf
• https://uploads.strikinglycdn.com/files/f1d35d08-5714-4154-a2aa-db866900506d/47960440087.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffnew.ru
• s3.amazonaws.com
• goduvozimaku.weebly.com
• wojedebaroz.weebly.com
• raralulewuk.weebly.com
• uploads.strikinglycdn.com
• kuzaloxamuw.weebly.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report