MALICIOUS — normal_5fe25218e47c7.pdf

MALICIOUS — normal_5fe25218e47c7.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: a3e83d974db6c825532e519ffba784bb65feda6c9a9ee16c2e16f85b603dcd49
• SHA-1: 1b224b8358d0f016facc0f1c4a7456f4b1d4a9e4
• MD5: 2187ba69832a98e864284228502b7753
• ssdeep: 1536:aiXlqbu5/Q6nKB9QUJIRnTbXRHlvcDSgG7XP+6unuONQ9Zux0TvMbpvt2s:b1qK5/3AJYhcILu7NQ9Zu0kbp7
• TLSH: T19F37D1F75053ED9C658B9B13ADB9192CA08CD38D7422EA2400C9776CC5F91ACBEA4D21
• Submitted as: normal_5fe25218e47c7.pdf
• File type: pdf · Size: 70413 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafficel.ru/123?utm_term=the+neatest+little+guide+to+investing, https://static1.squarespace.com/static/5fe17336df1c1b7078dcf66c/t/5fe18e7e70f55f6f05f0d6e8/1608617598600/adobe_audition_cc_2018_kuyhaa.pdf, https://static1.squarespace.com/static/5fc0cc948139af037644bbed/t/5fc2dc353f75b1664332d116/1606605878068/tulipoj.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafficel.ru/123?utm_term=the+neatest+little+guide+to+investing
• https://static1.squarespace.com/static/5fe17336df1c1b7078dcf66c/t/5fe18e7e70f55f6f05f0d6e8/1608617598600/adobe_audition_cc_2018_kuyhaa.pdf
• https://static1.squarespace.com/static/5fc0cc948139af037644bbed/t/5fc2dc353f75b1664332d116/1606605878068/tulipoj.pdf
• https://s3.amazonaws.com/mokuwanibof/punjabi_song_audio_gane.pdf
• https://s3.amazonaws.com/pazerogasarinu/4714946884.pdf
• https://s3.amazonaws.com/zagubip/los_angeles_lakers_injury_report.pdf
• https://s3.amazonaws.com/pusolefosex/90416981252.pdf
• https://s3.amazonaws.com/waxapoz/35567032112.pdf
• https://s3.amazonaws.com/sazariwapa/best_software_for_pc_site.pdf
• https://static1.squarespace.com/static/5fc79cbd418d7934ac780470/t/5fc8e3f87ff5a343eb008b12/1607001081084/evowars._io_crazy_games.pdf
• https://s3.amazonaws.com/dukavunivifa/94396921844.pdf
• https://uploads.strikinglycdn.com/files/26f6b363-1f2f-4566-81bc-acd65ac3a41d/tagubazaguratubivanekapog.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafficel.ru
• static1.squarespace.com
• s3.amazonaws.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report