MALICIOUS — 4992266.pdf

MALICIOUS — 4992266.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: 886f675e24cdc6f304209c62352ca4647534284a89f391454752a40eae89aec1
• SHA-1: 150011e24c57c3e70c9f6e343dc23b90b6711c4c
• MD5: 80160da93a91cfe33c04b96706e87959
• ssdeep: 1536:DLxQfmvEOElt/SCA27Cj7aVIMqMl/I08sflH+:kmMZXSCA2upgl/oaY
• TLSH: T19036DFF35017CDCC6796EB033D6A145D648AD188A125F7A488C8BBBCC878ABD3D50E51
• Submitted as: 4992266.pdf
• File type: pdf · Size: 67212 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://gettraff.ru/wb?keyword=courtesy%20words%20worksheet, https://uploads.strikinglycdn.com/files/639f5fb2-da6b-475e-857d-63f74e575e2e/sonufakuminutasadosine.pdf, https://uploads.strikinglycdn.com/files/56ddb5d4-8098-42e5-b8b7-bbaccfcbecb7/how_to_grow_wings_on_your_back.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/wb?keyword=courtesy%20words%20worksheet
• https://uploads.strikinglycdn.com/files/639f5fb2-da6b-475e-857d-63f74e575e2e/sonufakuminutasadosine.pdf
• https://s3.amazonaws.com/pazerogasarinu/unblock_miniclip_games.pdf
• https://s3.amazonaws.com/temujonuwu/sabowubujavoredudub.pdf
• https://s3.amazonaws.com/henghuili-files2/brandenburg_concerto_5_sheet_music.pdf
• https://uploads.strikinglycdn.com/files/56ddb5d4-8098-42e5-b8b7-bbaccfcbecb7/how_to_grow_wings_on_your_back.pdf
• https://s3.amazonaws.com/lakadutof/mutated_zygomites_osrs_fossil_island.pdf
• https://s3.amazonaws.com/kexamoxusinixu/womusekokebinu.pdf
• https://cdn-cms.f-static.net/uploads/4404108/normal_5f9aa1a59ffaf.pdf
• https://s3.amazonaws.com/subud/solubilities_of_inorganic_and_organic_compounds.pdf
• https://uploads.strikinglycdn.com/files/cfd4fddd-db6a-4d89-a5ef-9b05c7c16104/61329374274.pdf
• https://uploads.strikinglycdn.com/files/b8585906-eaeb-4098-a495-d6e8f7ba6090/chrome_wheel_repair_sacramento.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• uploads.strikinglycdn.com
• s3.amazonaws.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report