MALICIOUS — 6a8e81c3.pdf

MALICIOUS — 6a8e81c3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 81c2b4f236ecaf247925392663fe68ff88f73010abd0b6c3b38c22621eb56539
• SHA-1: 6595cde1aba8fcdac33685ec2b496cf84d3ae9ca
• MD5: 7187c5c841f8a4e325bb9ab2140c6af3
• ssdeep: 1536:8TgiLG+DIzQP8lOl1noU0seaAjRgvcYkyKS26rnrsKsbb:oLDsULL3W2vcxwu
• TLSH: T1AC37D0F33157DD8CB7AB6B4355FB1A29780AC7881123A7205185BA7DC87C9BC2D50B21
• Submitted as: 6a8e81c3.pdf
• File type: pdf · Size: 71348 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafftec.ru/wb?keyword=birthday%20wishes%20card%20with%20name%20free, https://uploads.strikinglycdn.com/files/42a7018c-ec38-4e31-97b3-9842fa643ca4/soropefuriwatofu.pdf, https://bugadubotureje.weebly.com/uploads/1/3/4/4/134468403/vakid.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafftec.ru/wb?keyword=birthday%20wishes%20card%20with%20name%20free
• https://uploads.strikinglycdn.com/files/42a7018c-ec38-4e31-97b3-9842fa643ca4/soropefuriwatofu.pdf
• https://s3.amazonaws.com/rikolesafuwofar/tecnologia_da_informao_aplicado_a_logistica.pdf
• https://s3.amazonaws.com/tujeviwakirawu/tovafasuro.pdf
• https://s3.amazonaws.com/dafalebinoza/blackweb_wireless_headphones_manual.pdf
• https://s3.amazonaws.com/zupenafud/xokavizorilowiverafise.pdf
• https://s3.amazonaws.com/gixirojozogufux/chamberlain_garage_door_opener_manual_for_myq.pdf
• https://s3.amazonaws.com/felasorarabipis/87075613285.pdf
• https://s3.amazonaws.com/sifawekujiki/spring_salamander_facts.pdf
• https://s3.amazonaws.com/nonabafat/adderall_and_viagra_combination.pdf
• https://bugadubotureje.weebly.com/uploads/1/3/4/4/134468403/vakid.pdf
• https://s3.amazonaws.com/tixedujegibex/basic_logarithm_worksheet.pdf
• https://cdn-cms.f-static.net/uploads/4416790/normal_5fa53835e66ae.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafftec.ru
• uploads.strikinglycdn.com
• s3.amazonaws.com
• bugadubotureje.weebly.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report