MALICIOUS — normal_5fc47a97d23c5.pdf

MALICIOUS — normal_5fc47a97d23c5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: bd422b9067e9fa259151e26c5ed3248047d485e4dbff3de7dfb22e4746a84840
• SHA-1: 8b461e4f3305c0de713c5d45a119c83ce8d0fca0
• MD5: 439c76c12ad77987d5a455fc6c93dfd7
• ssdeep: 1536:aTGEBC0MEJ6yQP7idKMgcTzY9MAl1wD3JcFUL+eXvk:wkvEJ6yg2vzaMAluD3i4M
• TLSH: T15236D0F3748BCD8D7A4B6B53BAE1116DA189D38C51329BE01408776E843D2BF9E60D90
• Submitted as: normal_5fc47a97d23c5.pdf
• File type: pdf · Size: 67393 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://cctraff.ru/123?utm_term=16+inch+wheel+covers, https://uploads.strikinglycdn.com/files/0130875e-22b2-4c61-bc80-a7d09ae5b46d/pisawijat.pdf, https://cdn-cms.f-static.net/uploads/4365608/normal_5f87961be9e19.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/123?utm_term=16+inch+wheel+covers
• https://uploads.strikinglycdn.com/files/0130875e-22b2-4c61-bc80-a7d09ae5b46d/pisawijat.pdf
• https://cdn-cms.f-static.net/uploads/4365608/normal_5f87961be9e19.pdf
• https://uploads.strikinglycdn.com/files/84a01809-ccf4-407b-b7ef-6b8f896e7aad/fefimav.pdf
• https://uploads.strikinglycdn.com/files/22defe4d-28ec-4244-ab10-9fc555d26af5/vefasotupawilutoxu.pdf
• https://lelewubinuzuton.weebly.com/uploads/1/3/4/7/134771703/1050889.pdf
• https://digavonuvuveg.weebly.com/uploads/1/3/4/8/134851043/jifofuzumules.pdf
• https://cdn-cms.f-static.net/uploads/4420230/normal_5fa63fc826137.pdf
• https://cdn-cms.f-static.net/uploads/4369762/normal_5f8a0f2b4bbb7.pdf
• https://uploads.strikinglycdn.com/files/f429e6ea-2981-4b4f-8a14-b2908458cfe4/firaxuborigesifupumatori.pdf
• https://cdn-cms.f-static.net/uploads/4422631/normal_5f9e74cda6fdc.pdf
• https://cdn-cms.f-static.net/uploads/4445338/normal_5fbe3375ab803.pdf
• https://uploads.strikinglycdn.com/files/06b086be-9fe1-4d36-898a-85fa88ce7b9f/63502156143.pdf
• https://uploads.strikinglycdn.com/files/c4d5c75b-97c0-4da9-b76e-c0844b7061a1/nosuremeforuberixagokak.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• lelewubinuzuton.weebly.com
• digavonuvuveg.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report