MALICIOUS — normal_5fc55a8ea86c4.pdf

MALICIOUS — normal_5fc55a8ea86c4.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: ba850af1c36f99799ae289a09667ceb596019574e018f8b3f575c0ffb42ada02
• SHA-1: 5572e93d6f514f3bba2bd92ce23e1814150bce44
• MD5: 973aa58bb043c01bc1d440323eb6539b
• ssdeep: 1536:y4lk47eg3Wawy5kNktpIpx6oFsctTFS/ecQUkq9ykmS4FELvuEfsRAYzAyR9DPtS:R+2hG7zNDpx6oFV5K3kq9ZdY2kC3jl
• TLSH: T1EF37C0F36097DC8CB996DB537DF625193486E2497025E6702488BF3C84B82BE7E10E51
• Submitted as: normal_5fc55a8ea86c4.pdf
• File type: pdf · Size: 72152 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafftec.ru/123?utm_term=haiku+graphic+organizer, https://static1.squarespace.com/static/5fc10fb5bda9c57a97bf17be/t/5fc173a3173fb5383bd99a19/1606513573646/93751396314.pdf, https://static1.squarespace.com/static/5fc0de27085bf90c0efce9ba/t/5fc261ad18e72e5fdb24c1da/1606574510109/rebodekokufuteludogi.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://trafftec.ru/123?utm_term=haiku+graphic+organizer
• https://static1.squarespace.com/static/5fc10fb5bda9c57a97bf17be/t/5fc173a3173fb5383bd99a19/1606513573646/93751396314.pdf
• https://s3.amazonaws.com/safago/26063265555.pdf
• https://static1.squarespace.com/static/5fc0de27085bf90c0efce9ba/t/5fc261ad18e72e5fdb24c1da/1606574510109/rebodekokufuteludogi.pdf
• https://s3.amazonaws.com/sugaguxagu/pathophysiology_of_cerebral_malaria.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe10d1f81c9a2a0c69ea38/1606291666184/jaxatevisidobuvavowu.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf7aa3ca23154c95aff1b/1606219691320/galufefagenexug.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4a18f3de5e49b55a6024/1606371864635/33468815797.pdf
• https://uploads.strikinglycdn.com/files/60d8ee0c-7056-4793-8f50-aa71c3905d84/indiana_jones_bring_back_to_us.pdf
• https://s3.amazonaws.com/guwutivupudutu/62509890071.pdf
• https://s3.amazonaws.com/fidefofudi/kerazi.pdf
• https://s3.amazonaws.com/tobobowu/wogenopirigera.pdf
• https://cdn-cms.f-static.net/uploads/4466135/normal_5fbf6b5761ae1.pdf
• https://static1.squarespace.com/static/5fc0da75085bf90c0efcd65a/t/5fc146bd3570fb44d131a36d/1606502079068/95991636235.pdf
• https://s3.amazonaws.com/roxawo/gojasufed.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafftec.ru
• static1.squarespace.com
• s3.amazonaws.com
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report