MALICIOUS — silidafakomaz_remif.pdf

MALICIOUS — silidafakomaz_remif.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 5e2867f2e431997c8dfec1fac9328d93df1ef596dd96a7f23382107dce506f8b
• SHA-1: 86c082c10d803452cc733b637a60bf20cdfc17bc
• MD5: bf054830dd00263e161f77076de3b10b
• ssdeep: 1536:Z1GUkWCL67nsdV2XD6fLu3Tu1f4wGqIuGoRqtAvA:O+7nsdWD6fTzGaG8qtJ
• TLSH: T10037C0F350C7EE987AC6A7535AA610AD618BD64834329BA4448CB33DC87C2FD6E15D02
• Submitted as: silidafakomaz_remif.pdf
• File type: pdf · Size: 72020 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffnew.ru/wb?keyword=uniform%20motion%20examples, https://cdn-cms.f-static.net/uploads/4410207/normal_5f977c40acd4f.pdf, https://cdn-cms.f-static.net/uploads/4383797/normal_5f99da3293108.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffnew.ru/wb?keyword=uniform%20motion%20examples
• https://cdn-cms.f-static.net/uploads/4410207/normal_5f977c40acd4f.pdf
• https://cdn-cms.f-static.net/uploads/4383797/normal_5f99da3293108.pdf
• https://uploads.strikinglycdn.com/files/ee27ac4d-81cd-4b64-8aad-9467f3c2fb54/cubase_7_crack_team_air.pdf
• https://s3.amazonaws.com/zuwimadaneb/dawemilifunisud.pdf
• https://uploads.strikinglycdn.com/files/a30c01de-f8ee-4b36-97a0-492ff72f839d/can_displacement_be_negative_explain.pdf
• https://jesasifewom.weebly.com/uploads/1/3/1/4/131453969/durikep-bifoxigupu-vadesib-biwufilo.pdf
• https://uploads.strikinglycdn.com/files/f2a62fae-7e03-4cba-8746-e77409bc809d/nfo_dosyas_ama.pdf
• https://pirowefe.weebly.com/uploads/1/3/4/4/134444143/d426d2fc87d9c0c.pdf
• https://uploads.strikinglycdn.com/files/ccc3cb36-d518-48b1-a26e-a1606e5b40e5/23646925118.pdf
• https://vilukenuxe.weebly.com/uploads/1/3/2/8/132814007/nakugirupexo.pdf
• https://cdn-cms.f-static.net/uploads/4374359/normal_5f9c5b0679922.pdf
• https://cdn-cms.f-static.net/uploads/4366375/normal_5f8d84f6c9266.pdf
• https://cdn-cms.f-static.net/uploads/4416654/normal_5f973c289d1ad.pdf
• https://uploads.strikinglycdn.com/files/ca581e32-7b60-4a83-b74a-d6c81dffb04a/solefuzotidenipatuma.pdf
• https://vavemome.weebly.com/uploads/1/3/4/6/134609594/jijimugeme.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffnew.ru
• cdn-cms.f-static.net
• uploads.strikinglycdn.com
• s3.amazonaws.com
• jesasifewom.weebly.com
• pirowefe.weebly.com
• vilukenuxe.weebly.com
• vavemome.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report