MALICIOUS — cea004b602277.pdf

MALICIOUS — cea004b602277.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: a6984130db73e75a117a4b340f90d78bbd45d4f795671a3a189fb10eb57e2dd2
• SHA-1: c95d1b71db95edeaad0e107889f09ae9a53be66b
• MD5: d61e06f7960bb51fe7b16432d71af02d
• ssdeep: 1536:Jn2Gmz1eTFtUjh7MKwUYoHWRBXgycSTgovzpg5PC5ra5HFF:pNiBjh7jnWnRcSEIgm8
• TLSH: T1E837D0F761D7EDCCB959AF43B5B7101CA04D86897532D6681889BB2DC9B82BD7F00A00
• Submitted as: cea004b602277.pdf
• File type: pdf · Size: 74633 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffnew.ru/wb?keyword=cracks%202009%20full%20movie, https://cdn-cms.f-static.net/uploads/4403119/normal_5fb3074a0af2c.pdf, https://uploads.strikinglycdn.com/files/3b07dc32-7128-4a06-abc9-50c29521619c/guzaw.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffnew.ru/wb?keyword=cracks%202009%20full%20movie
• https://cdn-cms.f-static.net/uploads/4403119/normal_5fb3074a0af2c.pdf
• https://uploads.strikinglycdn.com/files/3b07dc32-7128-4a06-abc9-50c29521619c/guzaw.pdf
• https://cdn-cms.f-static.net/uploads/4427103/normal_5fa8c90d7efdf.pdf
• https://uploads.strikinglycdn.com/files/2552e191-1fc8-4cce-b048-9b91e6e13c37/discografia_marcos_witt.pdf
• https://uploads.strikinglycdn.com/files/cafd1b88-ae87-4724-b541-6f67e3fdadb7/broncomail_boise_state.pdf
• https://cdn-cms.f-static.net/uploads/4370317/normal_5f895dd61e2ab.pdf
• https://uploads.strikinglycdn.com/files/d9f1f911-eb53-454b-94f7-ef502d67f8bc/diwepemupogil.pdf
• https://uploads.strikinglycdn.com/files/157f503d-b9cc-43ef-abd9-b3833e50facf/panasonic_sr_de103.pdf
• https://cdn-cms.f-static.net/uploads/4380210/normal_5f8c9f6505acb.pdf
• https://cdn-cms.f-static.net/uploads/4498882/normal_5fb9693aca5fc.pdf
• https://uploads.strikinglycdn.com/files/8539cfea-6af4-40e7-aad3-6a25c9fb79fe/fexadutowoma.pdf
• https://uploads.strikinglycdn.com/files/adc32bab-5b15-41c2-a4d9-5e6e6304d03d/pond5_music_review_time.pdf
• https://uploads.strikinglycdn.com/files/5acbd49b-eac1-44b9-bc67-72b7e37bc2db/jopazavasidik.pdf
• https://uploads.strikinglycdn.com/files/83c02833-9c41-4efb-b174-edc2b3bfb350/trigonometri_zor_sorular.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffnew.ru
• cdn-cms.f-static.net
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report