MALICIOUS — normal_5fcecc2c4482c.pdf

MALICIOUS — normal_5fcecc2c4482c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 7ce2e1fe03b937c6f5dba2138c7e0c1a0e3c22303ce893453d99a19ed8a9e5f5
• SHA-1: d7f5d365068ba5f4082e62a4fa036dd0396256c4
• MD5: 710a41a8d9e22d38630d29435aae2b31
• ssdeep: 1536:fQ6KBtOo4HV9zNHzZ5hjPid0NM+SJoePKww2HN+jcTBo/UZZ9dg6aH0m:ojbOo+HzZ/9/SwF0+U79S6aN
• TLSH: T17737DFF33087ED8D67C67F57ADFA421E789AC28832719AE550C8B56C80B85FD2E10850
• Submitted as: normal_5fcecc2c4482c.pdf
• File type: pdf · Size: 71537 bytes
• Verdict: malicious (96/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4409627/normal_5fcdb7a1d2eb2.pdf - network signal, weight 0.70, confidence 0.80
• Embedded network infrastructure: https://traffine.ru/123?utm_term=oracle+reports+11g+download, https://static.s123-cdn-static.com/uploads/4409627/normal_5fcdb7a1d2eb2.pdf, https://cdn-cms.f-static.net/uploads/4406820/normal_5f9616a25d8dd.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://traffine.ru/123?utm_term=oracle+reports+11g+download
• https://static.s123-cdn-static.com/uploads/4409627/normal_5fcdb7a1d2eb2.pdf
• https://cdn-cms.f-static.net/uploads/4406820/normal_5f9616a25d8dd.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcfae18cb11b25c09bd9a3/1606220514110/silkie_chickens_for_sale_nc.pdf
• https://static.s123-cdn-static.com/uploads/4379723/normal_5fca330435d6a.pdf
• https://uploads.strikinglycdn.com/files/91c571a0-7513-48ea-8d4f-a5783561bb79/pujuvozidisujoziduwi.pdf
• https://static1.squarespace.com/static/5fc2a167cd1e280355df4762/t/5fc78d0a3d56556d14411810/1606913293773/neon_green_black_nails.pdf
• https://cdn-cms.f-static.net/uploads/4376086/normal_5fbf5a9981732.pdf
• https://static.s123-cdn-static.com/uploads/4500670/normal_5fc7588c67b10.pdf
• https://uploads.strikinglycdn.com/files/57008ecd-644a-4014-a625-34347c0351a6/1004110038.pdf
• https://uploads.strikinglycdn.com/files/a0d267a4-6116-409c-855e-b11f5e56de90/widepokagi.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffine.ru
• static.s123-cdn-static.com
• cdn-cms.f-static.net
• static1.squarespace.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report