MALICIOUS — 5813713.pdf

MALICIOUS — 5813713.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: c7f3967eca2bf22b14425fcdda7eaae8d15ca5a64477c72073342b2232624def
• SHA-1: ae38a5765c3758a7524b8bd6ecd776ba8d57fd96
• MD5: 5991a3ed4ca10f556e1f3619c9c5dbe6
• ssdeep: 1536:4iQ0RPvR+ws5f+PrPzJTBxXsVlTXKfVqh3YRy49bC1L0G3m5mMD02Sy/rKOkKQ:JQ0RkwsyjBXolTafVqh3aZ9bNG3E8JyQ
• TLSH: T13A37C0F35187CDCC7B6767136DA718386419C6897172DA24608CBA6C817CBEE7E01E22
• Submitted as: 5813713.pdf
• File type: pdf · Size: 71952 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffset.ru/wb?keyword=bilaspur%20university%20syllabus, https://kelobutino.weebly.com/uploads/1/3/0/9/130969458/bc903b28.pdf, https://tunuwowidu.weebly.com/uploads/1/3/4/6/134606858/miguvazekiwixopijoli.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffset.ru/wb?keyword=bilaspur%20university%20syllabus
• https://s3.amazonaws.com/rirusozo/93820486078.pdf
• https://kelobutino.weebly.com/uploads/1/3/0/9/130969458/bc903b28.pdf
• https://s3.amazonaws.com/ganubatebedoxez/41919640153.pdf
• https://tunuwowidu.weebly.com/uploads/1/3/4/6/134606858/miguvazekiwixopijoli.pdf
• https://s3.amazonaws.com/dudurat/adownloader_app_fire_tablet.pdf
• https://uploads.strikinglycdn.com/files/2d659d68-7b61-4509-aed2-40e044703e52/9007504326.pdf
• https://pegebitejujag.weebly.com/uploads/1/3/4/4/134445458/valetugibujetet.pdf
• https://s3.amazonaws.com/xamibudasagas/pincered_insect_crossword_answers.pdf
• https://danizodeker.weebly.com/uploads/1/3/4/5/134581754/befiwuge.pdf
• https://vewirorerisemi.weebly.com/uploads/1/3/4/6/134627211/5300819.pdf
• https://s3.amazonaws.com/tesodagiwor/nemawajitiribaronage.pdf
• https://uploads.strikinglycdn.com/files/c1772883-2844-471d-963b-517366d8449b/nyc_food_protection_course_final_exam_answers.pdf
• https://talapilodegopez.weebly.com/uploads/1/3/0/9/130969507/pamerov_suzumebisemuze_pufejowowugi.pdf
• https://nukubutoti.weebly.com/uploads/1/3/2/3/132302768/5518748.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffset.ru
• s3.amazonaws.com
• kelobutino.weebly.com
• tunuwowidu.weebly.com
• uploads.strikinglycdn.com
• pegebitejujag.weebly.com
• danizodeker.weebly.com
• vewirorerisemi.weebly.com
• talapilodegopez.weebly.com
• nukubutoti.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report