MALICIOUS — normal_5fc557c310548.pdf

MALICIOUS — normal_5fc557c310548.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: 62012595869d091adcf80eb7a6306716286f1e7b8e92100ee6f04755657b8f26
• SHA-1: 067efbfc92f25bba2759bd877e693f693d8dd785
• MD5: d57da464dd872bfe5e556b1a2d948b43
• ssdeep: 1536:iz7i2M7+NEUNWHSwz3KZawMkBDNWpNsCo/8c7oK+Q7jpXccx:mvM6Nv06NpWpWPQQnpTx
• TLSH: T1CB36D0F75083DD9C7A462F837DF7241CA59AD6496422EFA414C87B2C9A387BD3E40901
• Submitted as: normal_5fc557c310548.pdf
• File type: pdf · Size: 68205 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: Trojan:PDF/Phish!atmn
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafffi.ru/123?utm_term=csn+bay+area+warriors, https://cdn-cms.f-static.net/uploads/4462694/normal_5fa76a932386c.pdf, https://cdn-cms.f-static.net/uploads/4426408/normal_5fa78bad22e4a.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafffi.ru/123?utm_term=csn+bay+area+warriors
• https://s3.amazonaws.com/xukonakefules/ponukazinawuxorewosi.pdf
• https://cdn-cms.f-static.net/uploads/4462694/normal_5fa76a932386c.pdf
• https://cdn-cms.f-static.net/uploads/4426408/normal_5fa78bad22e4a.pdf
• https://cdn-cms.f-static.net/uploads/4467286/normal_5fa58e5b074de.pdf
• https://uploads.strikinglycdn.com/files/abfdbc64-20aa-4f86-b21f-c9e358006bf9/dafimusa.pdf
• https://s3.amazonaws.com/lovetijif/energy_android_smart_tv_box_manual.pdf
• https://cdn-cms.f-static.net/uploads/4377403/normal_5f8ce4435fbcc.pdf
• https://cdn-cms.f-static.net/uploads/4370280/normal_5f8ef708782ab.pdf
• https://cdn-cms.f-static.net/uploads/4375887/normal_5fb4f61d0202c.pdf
• https://cdn-cms.f-static.net/uploads/4404105/normal_5f95c3ff4f0f9.pdf
• https://cdn-cms.f-static.net/uploads/4413363/normal_5f9be88f221c2.pdf
• https://s3.amazonaws.com/xabalaru/thermotherapy_sheet_mask.pdf
• https://cdn-cms.f-static.net/uploads/4487419/normal_5faece021abca.pdf
• https://cdn-cms.f-static.net/uploads/4422367/normal_5faafede6bac2.pdf
• https://topagolidokade.weebly.com/uploads/1/3/4/5/134502990/cc9f46199879534.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffi.ru
• s3.amazonaws.com
• cdn-cms.f-static.net
• uploads.strikinglycdn.com
• topagolidokade.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report