MALICIOUS — c3b5654.pdf

MALICIOUS — c3b5654.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 530f004dcdd87dd48a3f1b8a8591858d00527ca0b3de59c32080bf0f54e00027
• SHA-1: dee311ad82efa87d3ef53a14526df948e6fe6079
• MD5: dcd7a15150027cb146f25dee76c221f7
• ssdeep: 1536:bK9CIbikUVRuRtJvuv1iXBWN5o8epwPGAaK/IluBWRWurZdR49Sr0VoR:O95+kDRtJGtiXBWbJeqPGlbuQAurDR4A
• TLSH: T10D37D0F321A6DC5CBA6AAB53579B0918A04CD78C6031ABB01488FB6CC47C3AD7F11660
• Submitted as: c3b5654.pdf
• File type: pdf · Size: 72228 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffnew.ru/wb?keyword=passive%20voice%20exercises%20with%20answers%20advanced%20level, https://cdn-cms.f-static.net/uploads/4367302/normal_5fbb92ce7296a.pdf, https://cdn-cms.f-static.net/uploads/4450354/normal_5fad90c1762c0.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffnew.ru/wb?keyword=passive%20voice%20exercises%20with%20answers%20advanced%20level
• https://s3.amazonaws.com/jipowumat/wow_classic_priest_leveling_guide_icy_veins.pdf
• https://s3.amazonaws.com/jofunozuzof/31100872765.pdf
• https://cdn-cms.f-static.net/uploads/4367302/normal_5fbb92ce7296a.pdf
• https://cdn-cms.f-static.net/uploads/4450354/normal_5fad90c1762c0.pdf
• https://cdn-cms.f-static.net/uploads/4365536/normal_5f9b9a115372b.pdf
• https://gononazenikemad.weebly.com/uploads/1/3/4/4/134482012/buronon_pisabuvinomeni_wenoki.pdf
• https://s3.amazonaws.com/gumegulaxi/sap_bpc_10._1_ms_installation_guide.pdf
• https://s3.amazonaws.com/texifaxepag/acs_atls_extension.pdf
• https://s3.amazonaws.com/sojaxub/vojoj.pdf
• https://dinumaditu.weebly.com/uploads/1/3/4/4/134479473/d332933c905504.pdf
• https://uploads.strikinglycdn.com/files/991bf342-7870-40ce-8aca-5344a1b7b148/gowirixasijupipot.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffnew.ru
• s3.amazonaws.com
• cdn-cms.f-static.net
• gononazenikemad.weebly.com
• dinumaditu.weebly.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report