MALICIOUS — fimilof.pdf

MALICIOUS — fimilof.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 85e746d175cc975b18455faad3e9e3a0c803c14403f3b5ee1bb3ce9711c5281c
• SHA-1: ca4f818dc55cf9a1c3770f9b003974b6a70c30ca
• MD5: c8b22632c1048f1ed6b604e392c7e72c
• ssdeep: 768:WgGzpD1sgcj31W3Z197RgyEwE5/hO6OzCF+1D+CLUJbQBDhXYnKCq+JN1IUWlx:DGFxs8H7Y5JliDhUJEBDhXSFIUWlx
• TLSH: T1D733B0F310E7ED9C3AC75F83ADAA01A5A18AC2847231E6605989777CC57C5BCAF00961
• Submitted as: fimilof.pdf
• File type: pdf · Size: 48699 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=metodos+de+abstinencia+periodica+pdf, https://cdn.shopify.com/s/files/1/0440/2675/7270/files/blockly_games_answers.pdf, https://cdn.shopify.com/s/files/1/0432/6077/2516/files/kali_linux_hacking_tutorials_in_hindi.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=metodos+de+abstinencia+periodica+pdf
• https://cdn.shopify.com/s/files/1/0440/2675/7270/files/blockly_games_answers.pdf
• https://cdn.shopify.com/s/files/1/0432/6077/2516/files/kali_linux_hacking_tutorials_in_hindi.pdf
• https://cdn.shopify.com/s/files/1/0433/9879/1322/files/nemesis_service_suite_nokia_free.pdf
• http://files.midwestskiesrock.com/uploads/1/3/1/3/131384081/6825637.pdf
• http://files.radarstrongjones.com/uploads/1/3/2/7/132710780/kuxamaj.pdf
• http://files.triplexfm.co.nz/uploads/1/3/0/8/130874050/4045807.pdf
• http://files.empireperformancept.com/uploads/1/3/1/3/131379935/luxidekopiri.pdf
• http://files.mendedhearts117.org/uploads/1/3/1/6/131637125/dufeduw.pdf
• http://jetonesa.southdennislibrary.org/uploads/1/3/0/9/130969214/640073.pdf
• http://files.heartawakemindfulness.com/uploads/1/3/1/4/131453733/toxuru_buxotivaju_riluzukija.pdf
• http://rozoj.glintofmischief.com/uploads/1/3/1/4/131438405/jiwawekiki-vupotok.pdf
• http://xabudapa.beachvilla5.com/uploads/1/3/1/3/131379538/398414e64d96d39.pdf
• http://files.alfromcanada.com/uploads/1/3/0/7/130739826/ad8928.pdf
• http://botalexop.brendagratton.com/uploads/1/3/1/3/131382243/083e753cc4b7c.pdf
• http://files.hole-group.com/uploads/1/3/1/1/131163752/7d8550cc88.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• cdn.shopify.com
• files.midwestskiesrock.com
• files.radarstrongjones.com
• files.empireperformancept.com
• files.mendedhearts117.org
• jetonesa.southdennislibrary.org
• files.heartawakemindfulness.com
• rozoj.glintofmischief.com
• xabudapa.beachvilla5.com
• files.alfromcanada.com
• botalexop.brendagratton.com
• files.hole-group.com
• www.w3.org
• purl.org
• ns.adobe.com
• files.triplexfm.co.nz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report