MALICIOUS — a51f9be03.pdf

MALICIOUS — a51f9be03.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 584c0120372d2d4803f24112382db0faf1e0f3fd3936c9e8d0049f1900cf7665
• SHA-1: 0a0f3a266b89d542e6fab1b6df83c80349e0c158
• MD5: 8ebe0d4335f98bc15e522db69c033b2b
• ssdeep: 1536:7IFXYkmeWEIcrjYATjHYPc7R5yESPjiB8pqEa7aM:EFMq407RXSiB0a1
• TLSH: T17E36E1F3B16BCD5C7A8BBB23A9B16A5A705DC2A43632D3741544BA2CC47C2DD3D20A11
• Submitted as: a51f9be03.pdf
• File type: pdf · Size: 69213 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafficel.ru/wb?keyword=canadian%20visa%20form%20not%20opening, https://uploads.strikinglycdn.com/files/5062eb91-e27e-4bda-8154-08afb67aa8ef/sefurozixul.pdf, https://uploads.strikinglycdn.com/files/a752d5a3-5f15-4882-91d9-0651f3757ed8/64234816427.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafficel.ru/wb?keyword=canadian%20visa%20form%20not%20opening
• https://uploads.strikinglycdn.com/files/5062eb91-e27e-4bda-8154-08afb67aa8ef/sefurozixul.pdf
• https://uploads.strikinglycdn.com/files/a752d5a3-5f15-4882-91d9-0651f3757ed8/64234816427.pdf
• https://uploads.strikinglycdn.com/files/7e723f08-e089-419d-a4f3-53b1ad074448/buy_here_pay_here_car_lots_rockford_illinois.pdf
• https://cdn-cms.f-static.net/uploads/4366969/normal_5f8ac077efe9c.pdf
• https://uploads.strikinglycdn.com/files/6d5382f4-d443-4759-975a-93ae81801d46/warofabufirunupuritu.pdf
• https://uploads.strikinglycdn.com/files/728f6957-5926-40a3-b971-a9c816175688/wilawuwapegapukukivibilar.pdf
• https://uploads.strikinglycdn.com/files/83e3fd74-6882-4a05-a0f8-84029bc2e502/60228000006.pdf
• https://uploads.strikinglycdn.com/files/4a5530bd-c1b9-4968-b64f-d498200c9136/gloria_steinem_wonder_woman.pdf
• https://uploads.strikinglycdn.com/files/46372554-accc-46e7-8474-27cdc92cd96e/61350275699.pdf
• https://uploads.strikinglycdn.com/files/2d331d92-92b2-4bbc-a54b-fd83e8813a47/52696917092.pdf
• https://uploads.strikinglycdn.com/files/8dfb5349-2c19-46d6-abf3-ba22cc05f922/lord_of_the_flies_ralph_appearance.pdf
• https://cdn-cms.f-static.net/uploads/4383688/normal_5fc0b116b7a0c.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafficel.ru
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report