MALICIOUS — normal_5ffb4fcc66ef2.pdf

MALICIOUS — normal_5ffb4fcc66ef2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: 5655b3a9ae786541acf181286ceff1ec96be095c7da70042d4299f985eafe7f2
• SHA-1: 6be4926ba1697d015870619927ab445dec38df85
• MD5: 2f184f8282d150c89a5246950335b943
• ssdeep: 1536:sz4W7dOk/50Ia2K4MiIbiEYPFeYjJUoedJ0CRJ0vMynmOT:C7ck/2IVtMiIbyIYjJu8CRJoF
• TLSH: T17837E0F36057EDCC76CF8B5339716268548AD788B23791104488F7ADC1BC6AEAF41990
• Submitted as: normal_5ffb4fcc66ef2.pdf
• File type: pdf · Size: 75523 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!2F184F8282D1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://cctraff.ru/123?utm_term=niveles+de+ingles, https://cdn.sqhk.co/piwixesiwufo/ey7NgcP/faledugedegebetugudesaxor.pdf, https://dolevepi.weebly.com/uploads/1/3/4/5/134587457/kudexewenemi_kabafum_sovelejaxak.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/123?utm_term=niveles+de+ingles
• https://cdn.sqhk.co/piwixesiwufo/ey7NgcP/faledugedegebetugudesaxor.pdf
• https://dolevepi.weebly.com/uploads/1/3/4/5/134587457/kudexewenemi_kabafum_sovelejaxak.pdf
• https://zadumeredevasax.weebly.com/uploads/1/3/1/4/131453870/sixaguzesexe.pdf
• https://cdn.sqhk.co/kedilexele/qOhfkQv/modern_zig_zag_chair.pdf
• https://s3.amazonaws.com/petubapizo/ielts_academic_writing_samples_band_9.pdf
• https://s3.amazonaws.com/dakebesuvum/nitegale.pdf
• https://xukanimuwuvam.weebly.com/uploads/1/3/2/6/132696198/pekakon-xenaku-malus.pdf
• https://cdn.sqhk.co/zowesifona/jaM81PU/ronolewakamiwiru.pdf
• https://s3.amazonaws.com/zukogi/53609053452.pdf
• https://zejaxosadakawur.weebly.com/uploads/1/3/4/3/134372542/f492a369e82ce02.pdf
• https://vojufutevale.weebly.com/uploads/1/3/4/5/134521456/5edbea11.pdf
• https://s3.amazonaws.com/wefemabeni/varicella-_zoster_virus_treatment_guidelines.pdf
• https://s3.amazonaws.com/negonanopix/85055987772.pdf
• https://s3.amazonaws.com/henghuili-files2/ruwoki.pdf
• https://s3.amazonaws.com/gapivegek/cowboy_bebop_script.pdf
• https://s3.amazonaws.com/jozetej/buyest_opinion_meaning.pdf
• https://s3.amazonaws.com/belapawerezuju/story_grammar_marker_worksheet.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• cdn.sqhk.co
• dolevepi.weebly.com
• zadumeredevasax.weebly.com
• s3.amazonaws.com
• xukanimuwuvam.weebly.com
• zejaxosadakawur.weebly.com
• vojufutevale.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report