MALICIOUS — tikivagafidunexif.pdf

MALICIOUS — tikivagafidunexif.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: b08faf380fd61c1a343e83c962761bf75eb56813a28eeed2b4e7b7862b05fd75
• SHA-1: a9ac619dd3fb376c41aa5c64fa9ecfc21097a72d
• MD5: a380a927efbb9f7769bb6e9d3896995e
• ssdeep: 1536:uXWGWPu91iiPqjkVvSPSCEicp4okqbQ6NFf2wdZe:OWGiuKxjkVQvcp7hbFf/dA
• TLSH: T11537D0F3629BCDCC75C65F876AB200A5A18EE398317299A05485B77CC47C63EFE60520
• Submitted as: tikivagafidunexif.pdf
• File type: pdf · Size: 71768 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafficel.ru/wb?keyword=ibm%20spss%20statistics%2025%20brief%20guide, https://cdn-cms.f-static.net/uploads/4486193/normal_5fc04fbf96798.pdf, https://cdn-cms.f-static.net/uploads/4471114/normal_5fbb25b05fd3b.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafficel.ru/wb?keyword=ibm%20spss%20statistics%2025%20brief%20guide
• https://cdn-cms.f-static.net/uploads/4486193/normal_5fc04fbf96798.pdf
• https://cdn-cms.f-static.net/uploads/4471114/normal_5fbb25b05fd3b.pdf
• https://s3.amazonaws.com/pibajuwi/11117761697.pdf
• https://s3.amazonaws.com/kakef/plane_geometry_worksheets_with_answers.pdf
• https://uploads.strikinglycdn.com/files/582c344d-e7c7-40bb-bcdf-4b52d499a32a/sub_zero_model_550_parts_manual.pdf
• https://uploads.strikinglycdn.com/files/92ae4e68-5cc7-421e-a2f2-05a22f00087f/designer_babies_pros_article.pdf
• https://s3.amazonaws.com/kakekojezutok/usna_summer_seminar_packing_list.pdf
• https://s3.amazonaws.com/tonisefoteka/fly_gps_apk_4.0.2.pdf
• https://s3.amazonaws.com/pesetufavo/equilibrio_ionico.pdf
• https://s3.amazonaws.com/subud/gurokujojagamididaboweji.pdf
• https://s3.amazonaws.com/napoledunadigo/torajubomovafasanibil.pdf
• https://uploads.strikinglycdn.com/files/b95c064c-9011-4527-bb1b-6933540bf3d8/dolores_cannon_between_death_and_life.pdf
• https://uploads.strikinglycdn.com/files/81b4ea0b-f6d8-4804-aa9d-c677e4c80d8f/79356570453.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafficel.ru
• cdn-cms.f-static.net
• s3.amazonaws.com
• uploads.strikinglycdn.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report