MALICIOUS — 4273321.pdf

MALICIOUS — 4273321.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 50 detection engines flagged it.

Identification

• SHA-256: a83a09c93dd71a300026f6d427f8ccac2bfc7ad92a80dc63043786cb1df66d67
• SHA-1: 4e171659597ff2150eb0491376aebb3fe1eea57f
• MD5: 8e42e50140973e90c7ec3567410ea7b3
• ssdeep: 768:ArSsHR9L0rfFxVGQoPOl7aOndqeEho8Cpyw7m3A02apO69TkzbPdMYEUwvVEu6Dr:ApWrfWOl1z8Qyw7mPA49Eu6DSQ6LZov
• TLSH: T12237E1F3A12BDF8CB6C6635738E70249548BC24D623267A05188365DD87C7BD3D20E62
• Submitted as: 4273321.pdf
• File type: pdf · Size: 74940 bytes
• Verdict: malicious (92/100)

Detections (5 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Trellix Stinger (McAfee): PDF/Phish-FAB!8E42E5014097
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffine.ru/wb?keyword=baby%20growth%20chart%20boy%20cdc, http://bosirizowu.rf.gd/14958057429.pdf, http://vakekaninu.iblogger.org/bluestacks_for_windows_7_free_filehippo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffine.ru/wb?keyword=baby%20growth%20chart%20boy%20cdc
• http://bosirizowu.rf.gd/14958057429.pdf
• http://vakekaninu.iblogger.org/bluestacks_for_windows_7_free_filehippo.pdf
• https://cdn.sqhk.co/borefigux/ahgWS78/merge_gun_shoot_zombie_online.pdf
• https://s3.amazonaws.com/gowebabuxogiro/if_you_judge_a_fish_by_its_ability_to_climb_a_tree_quote_meaning.pdf
• https://site-1172901.mozfiles.com/files/1172901/26237357095.pdf
• https://site-1178429.mozfiles.com/files/1178429/thunder_assault_raiden_striker.pdf
• http://wemiwapava.epizy.com/34718041001.pdf
• https://site-1176154.mozfiles.com/files/1176154/radutojikumod.pdf
• https://site-1167928.mozfiles.com/files/1167928/kekamemaf.pdf
• https://site-1168414.mozfiles.com/files/1168414/ios_7_space_wallpaper_ipad.pdf
• http://misukejijixuke.epizy.com/76637622035.pdf
• https://site-1172709.mozfiles.com/files/1172709/26362355128.pdf
• https://s3.amazonaws.com/fazujo/go_for_no.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffine.ru
• vakekaninu.iblogger.org
• cdn.sqhk.co
• s3.amazonaws.com
• site-1172901.mozfiles.com
• site-1178429.mozfiles.com
• wemiwapava.epizy.com
• site-1176154.mozfiles.com
• site-1167928.mozfiles.com
• site-1168414.mozfiles.com
• misukejijixuke.epizy.com
• site-1172709.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com
• bosirizowu.rf.gd

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report