MALICIOUS — normal_5fcf5e7c057f5.pdf

MALICIOUS — normal_5fcf5e7c057f5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: a583e1e1a010e74e220221a42ce1b66de2e0573efdc6b1f2dabcdd0cd2936b51
• SHA-1: e4236ffbcb985a8c925f7342cdf6f151bb76173b
• MD5: bfaab1b818c7f03bf446323a813f735c
• ssdeep: 1536:V9rVFjiCaPbWHbIQGDvcO8oTcnE+4NbYhynEPZNc/RI4aOze0JP+1:LDjN2bSy7ttD1NbTEhG/RImzesPc
• TLSH: T15637D0F36143CE9C7A528303A97B545C650AD78CAD3287A058CC763CC8785FEBE25A11
• Submitted as: normal_5fcf5e7c057f5.pdf
• File type: pdf · Size: 70598 bytes
• Verdict: malicious (94/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://furiraduwonejos.weebly.com/uploads/1/3/4/8/134870793/322cf.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://traffset.ru/123?utm_term=how+to+tame+a+skeleton+horse+in+minecraft+ps4, https://uploads.strikinglycdn.com/files/45d88f9c-d138-4c7f-88f5-c94e1c762580/41410888789.pdf, https://uploads.strikinglycdn.com/files/eb2629de-c679-4d09-98c8-90e9d8f65ee5/lamopajo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffset.ru/123?utm_term=how+to+tame+a+skeleton+horse+in+minecraft+ps4
• https://s3.amazonaws.com/sukedil/paul_rodriguez_skater_net_worth.pdf
• https://s3.amazonaws.com/degisapemifa/purble_place_cake_game_for_pc.pdf
• https://uploads.strikinglycdn.com/files/45d88f9c-d138-4c7f-88f5-c94e1c762580/41410888789.pdf
• https://uploads.strikinglycdn.com/files/eb2629de-c679-4d09-98c8-90e9d8f65ee5/lamopajo.pdf
• https://furiraduwonejos.weebly.com/uploads/1/3/4/8/134870793/322cf.pdf
• https://uploads.strikinglycdn.com/files/df1a0d3a-39a3-4282-87d7-98b0bdb50b11/74280152134.pdf
• https://s3.amazonaws.com/nuvukivaxiren/xalobupurez.pdf
• https://s3.amazonaws.com/roware/olympus_om-2_camera_manual.pdf
• https://giguwazepijev.weebly.com/uploads/1/3/4/8/134870268/gororoberulejuwesav.pdf
• https://s3.amazonaws.com/musoxifuvitalo/cdf_file_format_mass_spectrometry.pdf
• https://mipolapepel.weebly.com/uploads/1/3/4/3/134395859/8969342.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffset.ru
• s3.amazonaws.com
• uploads.strikinglycdn.com
• furiraduwonejos.weebly.com
• giguwazepijev.weebly.com
• mipolapepel.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report