MALICIOUS — normal_5fc8db6859270.pdf

MALICIOUS — normal_5fc8db6859270.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 907a61cbcbce9d0c0412a62598aa13005c1074aac2975ae433c5546962e0d7fe
• SHA-1: a4745ac8cfd9f3a3c16b13371b972f8643dadd9e
• MD5: c254ca2bd755653caed649f1add18df2
• ssdeep: 1536:qIwuG3Ig9o42kkeeSTmuvVsZaWVHMMOkSP16ISXM4mjlX8ltZMV31:qIQo42kdJ6uvaaWFdSt6Ij4od0tZMF
• TLSH: T1A637C1F3924FCD8D3AC3AB9365A659256087DBC43232A7540044BE6CC8BC6BC6F51A91
• Submitted as: normal_5fc8db6859270.pdf
• File type: pdf · Size: 74351 bytes
• Verdict: malicious (94/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://static1.squarespace.com/static/5fc2c8fa27a199023ac1a380/t/5fc871972dd5737571b4d269/1606971808143/minecraft_color_chat_generator.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://trafffe.ru/123?utm_term=visual+basic.net+database+programming+for+dummies+pdf, https://static1.squarespace.com/static/5fc2c8fa27a199023ac1a380/t/5fc871972dd5737571b4d269/1606971808143/minecraft_color_chat_generator.pdf, https://uploads.strikinglycdn.com/files/1dd087f2-4fc4-421b-9eb4-4da1321dee97/96969093398.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafffe.ru/123?utm_term=visual+basic.net+database+programming+for+dummies+pdf
• https://static1.squarespace.com/static/5fc2c8fa27a199023ac1a380/t/5fc871972dd5737571b4d269/1606971808143/minecraft_color_chat_generator.pdf
• https://uploads.strikinglycdn.com/files/1dd087f2-4fc4-421b-9eb4-4da1321dee97/96969093398.pdf
• https://mimitokiwunas.weebly.com/uploads/1/3/4/0/134012498/dilafalesob.pdf
• https://uploads.strikinglycdn.com/files/f06060be-c875-48d7-8cf4-81cfc77f8d3d/bank_of_america_apk.pdf
• https://uploads.strikinglycdn.com/files/26608c3d-fc88-4e6c-8042-f450fff9efe5/libros_sobre_infidelidad.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf6c8f7acac6192ab982dd/1606380691301/4449384726.pdf
• https://static1.squarespace.com/static/5fc571e9abaecd331840d47e/t/5fc6180c1972c46e3c6ed56a/1606817806714/first_words_of_the_declaration_of_independence.pdf
• https://uploads.strikinglycdn.com/files/3c1a553c-4d7c-439c-85df-ec08bcc75efa/zilozixuvimiso.pdf
• https://uploads.strikinglycdn.com/files/51620190-12d9-4b2a-941a-314e8f33b33c/sipokimamunanedegog.pdf
• https://uploads.strikinglycdn.com/files/632b71f3-241b-4553-a641-1d16d6fc1af1/sutomomupu.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffe.ru
• basic.net
• static1.squarespace.com
• uploads.strikinglycdn.com
• mimitokiwunas.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report