MALICIOUS — normal_5fc6cb980ad18.pdf

MALICIOUS — normal_5fc6cb980ad18.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 8f406d5dbce9a9f83c15081887bed7d971fb643f24ac01ab18abb8e13db7fc74
• SHA-1: cc9ccdbd25445bb049ee5b9adf8d9f8b306d0f00
• MD5: 84683c2b1e80b2091bd0feff65fba038
• ssdeep: 1536:91DYlI9Mdip4YsOBRl6z7U3Wi9vC3AdLzulNP5CqjPmUaaAVKi5A7Fg:PY50p49ARl63AWi9vCwd3oNP4UCVRAi
• TLSH: T1FB37D0F3A25BED8CF9956703AAB6107D706DC6887137CE90548CF67C89B85AE6C14C20
• Submitted as: normal_5fc6cb980ad18.pdf
• File type: pdf · Size: 72100 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://gettraff.ru/123?utm_term=monster+poem+with+alliteration+and+rhyme, https://mixirarorasuju.weebly.com/uploads/1/3/4/3/134317495/soser.pdf, https://static1.squarespace.com/static/5fc1976bb8467722f1d927cd/t/5fc2d3a33485235c862430d3/1606603684630/sweet_evil_online.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/123?utm_term=monster+poem+with+alliteration+and+rhyme
• https://mixirarorasuju.weebly.com/uploads/1/3/4/3/134317495/soser.pdf
• https://static1.squarespace.com/static/5fc1976bb8467722f1d927cd/t/5fc2d3a33485235c862430d3/1606603684630/sweet_evil_online.pdf
• https://static1.squarespace.com/static/5fc54343116eb00e3c68afb8/t/5fc6bff5b2fa4660c8bcf075/1606860790286/jidawunigosevakuveku.pdf
• https://uploads.strikinglycdn.com/files/965adb57-1139-4f22-a6e5-4f1702b49b29/battle_of_stalingrad_turning_point_in_world_war_2.pdf
• https://static1.squarespace.com/static/5fc00a5311f6a4198480ec6e/t/5fc33e963c6ccf69f3c77e32/1606631072831/r_error_in_filefile.pdf
• https://uploads.strikinglycdn.com/files/a86a0ac5-7189-4726-a780-acdaafc4af6b/how_to_make_apk_android_studio.pdf
• https://static1.squarespace.com/static/5fc5515dea4a794d56626c14/t/5fc5e1641972c46e3c6a18ec/1606803812541/22_clues_cheats_level_10.pdf
• https://uploads.strikinglycdn.com/files/52ae1efe-0153-4ca2-87d4-fd6cb4d8defb/78645017012.pdf
• https://uploads.strikinglycdn.com/files/49f503ec-e60a-4ddd-a342-5130412bed60/breaking_strongholds_in_your_life.pdf
• https://sunajekivogemaz.weebly.com/uploads/1/3/4/8/134895881/zavowegivaso_koziwi_bobovo_vilokizose.pdf
• https://s3.amazonaws.com/mamibis/semitic_religions.pdf
• https://uploads.strikinglycdn.com/files/25801f79-41a1-44b9-9a40-046dbb9bae13/63292551282.pdf
• https://uploads.strikinglycdn.com/files/3a000db2-091e-4145-b84e-f44944dfd427/37871597404.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• mixirarorasuju.weebly.com
• static1.squarespace.com
• uploads.strikinglycdn.com
• sunajekivogemaz.weebly.com
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report