MALICIOUS — caf33f9a5f2.pdf

MALICIOUS — caf33f9a5f2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: c8b0eaa51430e1e2413af25c1a10e0e2b38468e02a420e232d2ded52a196d224
• SHA-1: 7e2f13c6036da8a94172a1c34a2ed3006f2cd65d
• MD5: 5610d21a77006f1a62c4f56f977179fa
• ssdeep: 1536:IeWdkqlw+Of0M05dDLkB+YFTBo1+uWwGa+Mzpo9UE/+WJZXyyE:5WdkqOUM055QfFTA+uVpoNpJZc
• TLSH: T19136CFF39097EE8CA98A6F436EB7115CB4CED38921339A605048772CD47C27EBE11951
• Submitted as: caf33f9a5f2.pdf
• File type: pdf · Size: 63710 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafficel.ru/wb?keyword=yamaha%20blaster%20repair%20manual, https://uploads.strikinglycdn.com/files/0be7e0a8-f9fe-41df-95cc-7e30d4875a27/kenefovusolisibomupuwe.pdf, https://cdn-cms.f-static.net/uploads/4388052/normal_5f9bc74b51a01.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafficel.ru/wb?keyword=yamaha%20blaster%20repair%20manual
• https://uploads.strikinglycdn.com/files/0be7e0a8-f9fe-41df-95cc-7e30d4875a27/kenefovusolisibomupuwe.pdf
• https://cdn-cms.f-static.net/uploads/4388052/normal_5f9bc74b51a01.pdf
• https://cdn-cms.f-static.net/uploads/4387933/normal_5f93c4932ce74.pdf
• https://s3.amazonaws.com/gixawetopoli/phone_app_free.pdf
• https://uploads.strikinglycdn.com/files/c475f996-b79d-43c2-958c-f70721d8e988/60303699074.pdf
• https://uploads.strikinglycdn.com/files/c9802d4e-449e-4125-8dd7-0402d973052e/2009993116.pdf
• https://cdn-cms.f-static.net/uploads/4391326/normal_5f944bc403654.pdf
• https://uploads.strikinglycdn.com/files/c44246e0-e43a-4c77-80a2-640b0aae61f4/galileo_pro_tablet_factory_reset.pdf
• https://cdn-cms.f-static.net/uploads/4444374/normal_5f9e784e5aebc.pdf
• https://cdn-cms.f-static.net/uploads/4404740/normal_5f96d4d96257b.pdf
• https://cdn-cms.f-static.net/uploads/4369519/normal_5fa2253d6d2cb.pdf
• https://uploads.strikinglycdn.com/files/2bea8bac-b84b-4106-aef5-16fed39d73b2/parulajovidalofoxakanerej.pdf
• https://s3.amazonaws.com/zamuriza/bubiremonodefivizagokab.pdf
• https://uploads.strikinglycdn.com/files/92b39f28-d8e7-4611-b558-1eaf08840603/xaxasutepupozak.pdf
• https://uploads.strikinglycdn.com/files/0a480e09-9fc3-4bcf-95ab-d90aeee6bec6/51504391086.pdf
• https://uploads.strikinglycdn.com/files/4c8881b3-caa9-46c3-b4a8-dc3d0074c645/tifizulize.pdf
• https://cdn-cms.f-static.net/uploads/4426556/normal_5fa9d0a2dcea1.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafficel.ru
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report