MALICIOUS — 6772717.pdf

MALICIOUS — 6772717.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 62df6d0f61a49c1400624ffd18ead0c93c2127f8b8d4b4edbad112ca5647c9a4
• SHA-1: 40590f589d61b438780f60758584f64202342bf0
• MD5: 2b7e971cc1356017aa0998713dfbed29
• ssdeep: 768:5gGzpDOLzbQRU/nZv6jtwwNQAuDcPSZk4/rMpiTRMAdjyDDqvPC:6GFqLLMtMDVk4wpiTBdaDqv6
• TLSH: T168328DF31157EE8D7A879B037EAA1459618AC74C7132A7A054DC336DC9BC2BC2E44A60
• Submitted as: 6772717.pdf
• File type: pdf · Size: 46141 bytes
• Verdict: malicious (70/100)

Detections (2 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://traffmen.ru/wb?keyword=pandora%20free%20app%20download, https://cdn-cms.f-static.net/uploads/4366036/normal_5f98e63b3b548.pdf, https://lodirunesu.weebly.com/uploads/1/3/0/8/130874391/kotawuzo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffmen.ru/wb?keyword=pandora%20free%20app%20download
• https://cdn-cms.f-static.net/uploads/4366036/normal_5f98e63b3b548.pdf
• https://lodirunesu.weebly.com/uploads/1/3/0/8/130874391/kotawuzo.pdf
• https://uploads.strikinglycdn.com/files/4280f1c0-ae4f-4848-9ceb-0328f316bb18/duck_life_2_on_math_playground.pdf
• https://s3.amazonaws.com/rovuweraja/slavery_in_kenya.pdf
• https://cdn-cms.f-static.net/uploads/4409096/normal_5f98966b5aab5.pdf
• https://uploads.strikinglycdn.com/files/26b4f8c5-78f2-4abc-88f9-ec79347fc135/wegudajogajajatixepubivof.pdf
• https://cdn-cms.f-static.net/uploads/4382780/normal_5f96bec1b02ff.pdf
• https://cdn-cms.f-static.net/uploads/4390373/normal_5f8e892c13eaa.pdf
• https://uploads.strikinglycdn.com/files/fe549fbd-974a-4918-aceb-25e038f1e90a/bubozivelaxa.pdf
• https://cdn-cms.f-static.net/uploads/4369656/normal_5f8e7d206d8fa.pdf
• https://cdn-cms.f-static.net/uploads/4455198/normal_5fa4234c5624e.pdf
• https://s3.amazonaws.com/wogikokuzotaxa/mazeril.pdf
• https://uploads.strikinglycdn.com/files/7ea44de8-c178-42dc-ab66-0b0b2e9f3e8b/gukefuk.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffmen.ru
• cdn-cms.f-static.net
• lodirunesu.weebly.com
• uploads.strikinglycdn.com
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report