MALICIOUS — normal_5fc687e67be3b.pdf

MALICIOUS — normal_5fc687e67be3b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 83cf58fafb8785d433ecd9e5828f83c269e800255d633565f7094d8bb61f5c99
• SHA-1: 983a11cfa04ebcb3206275f914d6bcf38e060600
• MD5: 6449e07cf56f13fc2c4d6ef52f28a469
• ssdeep: 1536:iXLRF/ND2gsFMotHNgiHAh84Nz315+/1mMrE3hj28hoo32i:SRF/N2HtHNgiH+FEtTiRooj
• TLSH: T18A36DFF363CBCD99B9C65F03BBB21925654DC3887132DB74608DB67C4AB82AD2E14901
• Submitted as: normal_5fc687e67be3b.pdf
• File type: pdf · Size: 67115 bytes
• Verdict: malicious (94/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://uploads.strikinglycdn.com/files/07963621-7413-4693-85ab-242f969372ad/ventura_star_obits.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://traffset.ru/123?utm_term=kingdom+hearts+tcg, https://uploads.strikinglycdn.com/files/07963621-7413-4693-85ab-242f969372ad/ventura_star_obits.pdf, https://uploads.strikinglycdn.com/files/ee61c70f-1671-40e8-9703-8f7f2fa03c77/jifirelarakugolikosubon.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffset.ru/123?utm_term=kingdom+hearts+tcg
• https://uploads.strikinglycdn.com/files/07963621-7413-4693-85ab-242f969372ad/ventura_star_obits.pdf
• https://uploads.strikinglycdn.com/files/ee61c70f-1671-40e8-9703-8f7f2fa03c77/jifirelarakugolikosubon.pdf
• https://s3.amazonaws.com/vukusa/meviverelagurokaje.pdf
• https://cdn-cms.f-static.net/uploads/4385231/normal_5fbc01c4c4dd0.pdf
• https://cdn-cms.f-static.net/uploads/4377912/normal_5f9a71fa2af51.pdf
• https://paxesejok.weebly.com/uploads/1/3/4/3/134348383/3250395.pdf
• https://uploads.strikinglycdn.com/files/d772ce97-1dd9-4fbe-b2d9-1252dc6c1b4e/96152608237.pdf
• https://cdn-cms.f-static.net/uploads/4370737/normal_5fad7e1ac7e24.pdf
• https://cdn-cms.f-static.net/uploads/4378830/normal_5f9b00de7706c.pdf
• https://cdn-cms.f-static.net/uploads/4482399/normal_5fb999ad340b5.pdf
• https://uploads.strikinglycdn.com/files/6584e731-e0db-4586-bada-0b67c07bb3b6/download_unravel_tokyo_ghoul_song.pdf
• https://uploads.strikinglycdn.com/files/d65d973b-e185-43df-9bcc-148bde2f740d/45910946.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffset.ru
• uploads.strikinglycdn.com
• s3.amazonaws.com
• cdn-cms.f-static.net
• paxesejok.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report