MALICIOUS — normal_5fc57bdc21874.pdf

MALICIOUS — normal_5fc57bdc21874.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: c9c7ad09eb1f2418671ce683e0a4e3d74ed7afe0e219397fb4abb87a3eb64d38
• SHA-1: 2458e35de465d643d48d75969fe5d4561e7b23fe
• MD5: e49185ffb7a1022f64fc4cbe1101d138
• ssdeep: 1536:NI/A5kzKGqu+KVpp1AHDPn6KqdaZqNxAmI9y6dCMUW:e45kzN3eP6j5xJCy6dCk
• TLSH: T10A36D1F7325BDD9DA24A8B23BD56412C90CDD28CA531A6E005C8773CC47C6BE7E11992
• Submitted as: normal_5fc57bdc21874.pdf
• File type: pdf · Size: 65040 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafftec.ru/123?utm_term=reengineering+the+corporation+michael+hammer+and+james+champy+pdf, https://uploads.strikinglycdn.com/files/a0ef5a2f-dc48-40b3-a6c6-5d0ae797eded/cleaning_jobs_rochester_ny.pdf, https://cdn-cms.f-static.net/uploads/4382643/normal_5f98dc6fca763.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafftec.ru/123?utm_term=reengineering+the+corporation+michael+hammer+and+james+champy+pdf
• https://uploads.strikinglycdn.com/files/a0ef5a2f-dc48-40b3-a6c6-5d0ae797eded/cleaning_jobs_rochester_ny.pdf
• https://cdn-cms.f-static.net/uploads/4382643/normal_5f98dc6fca763.pdf
• https://uploads.strikinglycdn.com/files/ec40a654-d9f2-4714-b7fc-8c7ebfa33d8b/types_of_chemical_reactions_worksheet_7-20.pdf
• https://cdn-cms.f-static.net/uploads/4422622/normal_5fa12eec6c35d.pdf
• https://cdn-cms.f-static.net/uploads/4383795/normal_5f90af17ad5c7.pdf
• https://s3.amazonaws.com/pazerogasarinu/38542517220.pdf
• https://s3.amazonaws.com/tosego/sikesi.pdf
• https://uploads.strikinglycdn.com/files/18ce26ac-ecee-4c70-8f76-1096f63cd06a/pevivevubiduwujajeketa.pdf
• https://cdn-cms.f-static.net/uploads/4419437/normal_5fbf54dc56910.pdf
• https://uploads.strikinglycdn.com/files/6d51c57d-90f2-4be0-bb01-fba3b25921e3/buvuruba.pdf
• https://uploads.strikinglycdn.com/files/0467b4a9-74ae-473c-9c27-8ab2853bd473/we_own_it_mp3_song_download_masstamilan.pdf
• https://s3.amazonaws.com/sazixipame/briggs_and_stratton_generator_parts_manual.pdf
• https://cdn-cms.f-static.net/uploads/4427097/normal_5faa3b24cf8fb.pdf
• https://cdn-cms.f-static.net/uploads/4412758/normal_5fa0d02d3c3dc.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafftec.ru
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report