MALICIOUS — normal_5fd0a149e1f6d.pdf

MALICIOUS — normal_5fd0a149e1f6d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: b95ea10727f57555dacfe62e1310a775304d6be8b80d05258606770a29823887
• SHA-1: 7b7ebd8b3a93a68c23163103d50ade28e52b3595
• MD5: a991ad8675fc004a363a201feefb56cf
• ssdeep: 1536:451e4+uluCkPz2fAW36KK79gCHsyfOmG+odEFfcco+RotAtqe3x:+1e4+uHkPz2OKK3No2F0cnfqg
• TLSH: T14737D0F3229BDEDD66892F43ABE7145DB01BC2893221E79454C87B6CC4B42BD7E10A41
• Submitted as: normal_5fd0a149e1f6d.pdf
• File type: pdf · Size: 69953 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://gettraff.ru/123?utm_term=the+broken+column+frida+kahlo+1944, https://static1.squarespace.com/static/5fc07dde27a199023ab34438/t/5fc16e0bf81c9a2a0cd7fadd/1606512141147/camp_half_blood_confidential.pdf, https://static1.squarespace.com/static/5fc55c8c8787e8798989a00a/t/5fcda91f83d2ac65cc305e15/1607313695907/kulebagukawigawutus.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://gettraff.ru/123?utm_term=the+broken+column+frida+kahlo+1944
• https://static1.squarespace.com/static/5fc07dde27a199023ab34438/t/5fc16e0bf81c9a2a0cd7fadd/1606512141147/camp_half_blood_confidential.pdf
• https://static1.squarespace.com/static/5fc55c8c8787e8798989a00a/t/5fcda91f83d2ac65cc305e15/1607313695907/kulebagukawigawutus.pdf
• https://static1.squarespace.com/static/5fc1cc6f0b6b03258f3bee00/t/5fcbc60f33fb14715cc3f8e3/1607190031991/smartthings_apple_homekit.pdf
• https://uploads.strikinglycdn.com/files/05b5c0b7-6b76-48f8-a3c9-3d892cc0bf11/nikakizemige.pdf
• https://uploads.strikinglycdn.com/files/e80aab66-e587-40da-ae36-75c01d20c12b/zumogenupadarul.pdf
• https://static1.squarespace.com/static/5fc13aebf7cf8c75402d1f76/t/5fc7f3fa33ed075e9dab9831/1606939643657/vodobevebipisel.pdf
• https://s3.amazonaws.com/mupukesunobaga/11818629733.pdf
• https://static1.squarespace.com/static/5fc4ffd688c99b6d37c18e02/t/5fce41e624c49707d34c2cff/1607352807195/road_builder_city_construction.pdf
• https://uploads.strikinglycdn.com/files/c93bc62a-470e-4bbe-a83d-17f2a31e49cf/zefenurezegara.pdf
• https://uploads.strikinglycdn.com/files/85f1cc52-e127-4ae4-a0ca-7ccbeef8ab1d/tokefewakibevowofamiv.pdf
• https://uploads.strikinglycdn.com/files/b566f51b-b2c8-4acc-9846-f40a97acd538/rulapasodawabuzewidopij.pdf
• https://static1.squarespace.com/static/5fc4d7f09698b02c7f39df58/t/5fc5b909cb3e0f577115ef1c/1606793484863/work_and_power_lab_how_fast_can_you_do_work_answer_key.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• static1.squarespace.com
• uploads.strikinglycdn.com
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report