MALICIOUS — normal_5fde70ee7b539.pdf
MALICIOUS — normal_5fde70ee7b539.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c7bcb914b12ddda20d0425b13df7341f72be271f5cd86a5660aa130de0a536f2 - SHA-1:
464d0780c7ed035b8fc826cc52189b6a72611f5c - MD5:
08cab1aec14b0ff1341017b6804b9bb5 - ssdeep:
1536:zowZaD0weJugKWaTGUEVz0X1zC+f0p1hSLsFkFqY1wl+le+noj/mI8aBM:VwDZngdsNEuX/0pHSR8Y1xFnu/mNz - TLSH:
T1CD39D0F3212FEC4D7B5AB7833B9A113C6485D68DB025875188CC7A5CC6B85FE6B20611 - Submitted as: normal_5fde70ee7b539.pdf
- File type: pdf · Size: 84470 bytes
- Verdict: malicious (94/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://static1.squarespace.com/static/5fc6b4b2d8e4f4479961d0df/t/5fca08f3be6684539df03d4a/1607076110962/sos_fomt_cooking_festival_theme.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://traffnew.ru/123?utm_term=mcguffey+primer+free, https://static1.squarespace.com/static/5fc6b4b2d8e4f4479961d0df/t/5fca08f3be6684539df03d4a/1607076110962/sos_fomt_cooking_festival_theme.pdf, https://uploads.strikinglycdn.com/files/7bb5676b-fae2-4d2f-b7fc-91f10874b712/59865785182.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://traffnew.ru/123?utm_term=mcguffey+primer+free
- https://static1.squarespace.com/static/5fc6b4b2d8e4f4479961d0df/t/5fca08f3be6684539df03d4a/1607076110962/sos_fomt_cooking_festival_theme.pdf
- https://uploads.strikinglycdn.com/files/7bb5676b-fae2-4d2f-b7fc-91f10874b712/59865785182.pdf
- https://uploads.strikinglycdn.com/files/a2781b35-d6ef-48ce-8fda-cac1deaa323d/all_about_me_poem_fill_in_the_blank.pdf
- https://cdn-cms.f-static.net/uploads/4374203/normal_5f8d713e84cc8.pdf
- https://uploads.strikinglycdn.com/files/0d194ead-5ab9-4282-a3c7-a664de9cd46e/2014_jetta_sportwagen_tdi.pdf
- https://s3.amazonaws.com/woxotopapozokev/35565542365.pdf
- https://uploads.strikinglycdn.com/files/90486a91-8b24-45c2-a837-b839b6fc2538/26760574124.pdf
- https://static1.squarespace.com/static/5fdcabee0a190b16b315d1db/t/5fdcf7f844709663001cde22/1608316921445/lebadawuxasejokosobojewa.pdf
- https://uploads.strikinglycdn.com/files/988f74f2-350c-492e-ade1-8fee62b34ba0/contrast_the_terms_ecology_and_environmentalism.pdf
- https://uploads.strikinglycdn.com/files/15bd9c5e-e783-4611-9d92-ba3dd936dcee/test_fax_number_canon.pdf
- https://static1.squarespace.com/static/5fc0f186bda9c57a97be6d6b/t/5fc3791c6457125654a8803d/1606646044598/john_gardner_on_leadership_summary.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- traffnew.ru
- static1.squarespace.com
- uploads.strikinglycdn.com
- cdn-cms.f-static.net
- s3.amazonaws.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report