MALICIOUS — normal_5ff4ddd421fbc.pdf

MALICIOUS — normal_5ff4ddd421fbc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: a7cd24ae061e6cb89d261fa7f7f1e5d1e54bb8f46820fefc468346dcd2d20cd8
• SHA-1: 1545af90715ca837d3caf291daa2e323713c1bb1
• MD5: 64c009ba34ed81ddf646c8364ce56d41
• ssdeep: 1536:JLLS6mdU6wBIcYF7YsFtxT85IwPPGGjneHgiiupT02duLToCnWPVeJBzrTtecw6Y:ZAq6TDF7lxT85Idmnfiiu90AulnEQbez
• TLSH: T14239D0F3025BCD8CBA969F53A9FA1569245ADB4C2131AF605084FB3CC03C6BD6F20A54
• Submitted as: normal_5ff4ddd421fbc.pdf
• File type: pdf · Size: 86412 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!64C009BA34ED
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffnew.ru/123?utm_term=jeff+beck+group+bass+player, https://cdn.sqhk.co/didozakir/cLgchch/replika_romantic_partner.pdf, https://uploads.strikinglycdn.com/files/9c9d7015-863f-4710-8903-47807e9575d3/how_to_make_maps_in_roll20.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://traffnew.ru/123?utm_term=jeff+beck+group+bass+player
• https://s3.amazonaws.com/gonima/65623847499.pdf
• https://s3.amazonaws.com/xefezesebusu/firefox_driver_for_mac.pdf
• https://s3.amazonaws.com/norozovijalu/itunes_para_linux.pdf
• https://cdn.sqhk.co/didozakir/cLgchch/replika_romantic_partner.pdf
• https://s3.amazonaws.com/fatikonavori/repinojux.pdf
• https://s3.amazonaws.com/tadevewuju/the_dark_knight_rises_apk_award.pdf
• https://uploads.strikinglycdn.com/files/9c9d7015-863f-4710-8903-47807e9575d3/how_to_make_maps_in_roll20.pdf
• https://uploads.strikinglycdn.com/files/d8b3ce0f-a4a1-41e2-b152-f906f6d3ad80/tecnica_zero_g_guide_pro_2020.pdf
• https://cdn.sqhk.co/sozaxejiv/aWi3thj/simcity_buildit_cheats_ios.pdf
• https://s3.amazonaws.com/felasorarabipis/adobe_acrobat_xi_pro_user_guide_download.pdf
• https://s3.amazonaws.com/zatazewoz/bengal_tiger_respiratory_system.pdf
• https://uploads.strikinglycdn.com/files/1b8aa07c-348d-4cd2-be0f-ef5b87eb4e99/gowavadaxu.pdf
• https://s3.amazonaws.com/xelimewat/13386893226.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffnew.ru
• s3.amazonaws.com
• cdn.sqhk.co
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

File paths

• J:\[

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report