MALICIOUS — normal_5fb7ffadb339f.pdf

MALICIOUS — normal_5fb7ffadb339f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 5e097a45e6fa4df1df38b524b7a3f525ef14f9960d19d02551e1206013913e3f
• SHA-1: 37417b74fff797ff8b9cf66667932a6ecdaeaf10
• MD5: 9ad2a2960d25fe3e8767e8fcf62a2caa
• ssdeep: 1536:C9XqCTx6PwejWnbm2hfDCMDwZZTEIMXztMOJ39Asj6WQG+/O7x:TCTJc6xQg+ujzzGGOu
• TLSH: T17C37E1B3718BDC8CBD86B7477D7A206DA08AC64C3065866550C97A6CC0FC6BE7E21E10
• Submitted as: normal_5fb7ffadb339f.pdf
• File type: pdf · Size: 73684 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffnew.ru/123?utm_term=how+to+write+an+equation+in+slope+intercept+form+calculator, https://cdn-cms.f-static.net/uploads/4413843/normal_5fa094600c032.pdf, https://uploads.strikinglycdn.com/files/237089cd-6365-4070-93e0-5eef56f9146e/18812195390.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffnew.ru/123?utm_term=how+to+write+an+equation+in+slope+intercept+form+calculator
• https://cdn-cms.f-static.net/uploads/4413843/normal_5fa094600c032.pdf
• https://uploads.strikinglycdn.com/files/237089cd-6365-4070-93e0-5eef56f9146e/18812195390.pdf
• https://uploads.strikinglycdn.com/files/bb22a839-d30d-481a-adc3-dd5d9f5c0491/88101088853.pdf
• https://uploads.strikinglycdn.com/files/342fcc67-f7b7-41b4-b864-5efd32643ac0/top_funny_memes_9.pdf
• https://uploads.strikinglycdn.com/files/602440aa-9045-4035-9290-95880e5f787b/icd_10_meibomian_gland_dysfunction.pdf
• https://mirigemiw.weebly.com/uploads/1/3/4/7/134753474/puxaloto-nodirokajizanu-rorawebebonopur.pdf
• https://s3.amazonaws.com/pewebopufupe/71338535939.pdf
• https://cdn-cms.f-static.net/uploads/4379048/normal_5f91cbb29228a.pdf
• https://uploads.strikinglycdn.com/files/78ea613d-e094-481c-87d0-9a7ad91e5b8e/gubun.pdf
• https://uploads.strikinglycdn.com/files/cd5119d5-7b96-42a9-983a-2b58b20e9a9d/69895592999.pdf
• https://tinozuxitijerel.weebly.com/uploads/1/3/4/5/134528375/kujinelamosovilixu.pdf
• https://uploads.strikinglycdn.com/files/cb664727-d850-4319-91a5-bd2cd48f83ff/57840883047.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffnew.ru
• cdn-cms.f-static.net
• uploads.strikinglycdn.com
• mirigemiw.weebly.com
• s3.amazonaws.com
• tinozuxitijerel.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report