MALICIOUS — rijofaveja.pdf

MALICIOUS — rijofaveja.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: c04b34335a7aa0b9bb1631aa8f4e666cc8ab8ed6e4544da7b08d379c0ff998cb
• SHA-1: 4720d137b7e1649fc71edefbcd765bf038b1fc03
• MD5: 57fdb569315aeaa87250ee23879e3dfa
• ssdeep: 1536:7EOnL+O3QWvegjb6ZBoMGL2d1h2KvJEPbE5VJAgmm5f5qw:o2LVQWWg/ioMlvJEPsJA/mp5d
• TLSH: T19535CFF360CBDD4CEA87C71328EB64267085D74CB532DBA014887B6C89786BE6E15B11
• Submitted as: rijofaveja.pdf
• File type: pdf · Size: 60290 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffmen.ru/wb?keyword=folktale%20story%20map%20template, https://cdn-cms.f-static.net/uploads/4366063/normal_5f87be36746c0.pdf, https://cdn-cms.f-static.net/uploads/4369503/normal_5f892a3f4f659.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffmen.ru/wb?keyword=folktale%20story%20map%20template
• https://s3.amazonaws.com/vigevot/fuji_mountain_bike_size_guide.pdf
• https://s3.amazonaws.com/radubozufiwo/latedajegoxe.pdf
• https://cdn-cms.f-static.net/uploads/4366063/normal_5f87be36746c0.pdf
• https://cdn-cms.f-static.net/uploads/4369503/normal_5f892a3f4f659.pdf
• https://s3.amazonaws.com/gurafoga/zobonapazavuputamuwosiw.pdf
• https://cdn-cms.f-static.net/uploads/4403407/normal_5f9854f1a241d.pdf
• https://s3.amazonaws.com/tenunud/mufoved.pdf
• https://s3.amazonaws.com/xukirizugukugi/30572155162.pdf
• https://s3.amazonaws.com/gofilafixu/tipico_restaurant_lynn.pdf
• https://s3.amazonaws.com/lupebesu/41151648245.pdf
• https://s3.amazonaws.com/wopari/41887266567.pdf
• https://cdn-cms.f-static.net/uploads/4465007/normal_5fbb1fc851124.pdf
• https://s3.amazonaws.com/dinigugaxej/35011638029.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffmen.ru
• s3.amazonaws.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report