MALICIOUS — normal_5fc9a9779cb46.pdf

MALICIOUS — normal_5fc9a9779cb46.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: aeceb2878690025f817009652ceb23d20e79f619799600e97c77c780bf2f9b50
• SHA-1: d9c75c780a2149778d282947a2091a0004782b12
• MD5: 4746fc16246ac4649c5438fb9c49e57f
• ssdeep: 1536:0v6BEdm1udTaeE4cWgI01bJAyUffjZso/48mEslPThGJbAMeZbPq7Fqvxx5s:w6BEwAs+h7fS1dGJbUY7Fqvxw
• TLSH: T11E37D1F3919BDECC6785AF437A9618182181D79C7072A6ED6584B67CC4383BCAE50E20
• Submitted as: normal_5fc9a9779cb46.pdf
• File type: pdf · Size: 71695 bytes
• Verdict: malicious (94/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

MITRE ATT&CK

• T1566.002

Why this verdict

The malicious score of 94/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded link rated suspicious by URL analysis: https://static1.squarespace.com/static/5fc0d7dc3dfdd95b60d4c91c/t/5fc2e73f4f983757203fa7d8/1606608703936/bexufonulukipufanezo.pdf - network signal, weight 0.40, confidence 0.60
• Embedded network infrastructure: https://traffmen.ru/123?utm_term=sea+cadets+uniform+cost, https://tedemikof.weebly.com/uploads/1/3/4/5/134593475/849010.pdf, https://static1.squarespace.com/static/5fc0d7dc3dfdd95b60d4c91c/t/5fc2e73f4f983757203fa7d8/1606608703936/bexufonulukipufanezo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffmen.ru/123?utm_term=sea+cadets+uniform+cost
• https://tedemikof.weebly.com/uploads/1/3/4/5/134593475/849010.pdf
• https://static1.squarespace.com/static/5fc0d7dc3dfdd95b60d4c91c/t/5fc2e73f4f983757203fa7d8/1606608703936/bexufonulukipufanezo.pdf
• https://s3.amazonaws.com/kopisigapub/51297416314.pdf
• https://s3.amazonaws.com/tagorarib/motion_in_one_dimension_problem_e_answer_key.pdf
• https://s3.amazonaws.com/kifutizijebuj/midejifufixagevivemore.pdf
• https://uploads.strikinglycdn.com/files/927942ed-f28d-43ce-81ed-e6d159322739/84390702822.pdf
• https://static1.squarespace.com/static/5fc32cce11f6a4198494824d/t/5fc5553308845d09243baa6e/1606767923920/windward_community_college_summer_2020.pdf
• https://static1.squarespace.com/static/5fc5072ec14dfd36fe0c117c/t/5fc99344e4017829c162fe42/1607045961326/bolimumomofajujikujixumo.pdf
• https://static1.squarespace.com/static/5fc2a934a879396864138857/t/5fc566f2f81c9a2a0c590cc8/1606772467637/tolebekadokegegidoxuxamor.pdf
• https://static1.squarespace.com/static/5fc3426faffbf90a66f9ae2f/t/5fc4ab0b2dd96f5918819f95/1606724363934/nicols_gmez_dvila_libros.pdf
• https://videxopefofima.weebly.com/uploads/1/3/4/1/134131768/minavuxa.pdf
• https://uploads.strikinglycdn.com/files/a9e0ff61-8c52-41dd-bd12-f42dac71e7a4/67781243567.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffmen.ru
• tedemikof.weebly.com
• static1.squarespace.com
• s3.amazonaws.com
• uploads.strikinglycdn.com
• videxopefofima.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report