MALICIOUS — 8254721.pdf
MALICIOUS — 8254721.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.
Identification
- SHA-256:
d1f6312fd0430ac3e33bc01fe92a5f7b41be6282eae9a9ab1aef9e235f057c70 - SHA-1:
a72be5a1d8ce49a99b14ec106f8d8e55138398f4 - MD5:
3828e456ceeb1bef61c103c412bb5643 - ssdeep:
1536:2gJFhcd89lmpMv3Lgiak+nR8lvbF4h0WeUBajfzQhw5k/dVasuBRyz3UFTc6WI2e:thcd4iyBnw0fzX56d3uBRkk9cRvbPK - TLSH:
T1D83AF1E7719FCC88FB8DAB03A8B6042A6159C1D975226E9C00D5BA7CC5B85FD7D20903 - Submitted as: 8254721.pdf
- File type: pdf · Size: 94916 bytes
- Verdict: malicious (92/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://trafficel.ru/wb?keyword=pdf%20standard%20beta%20distribution, https://cdn-cms.f-static.net/uploads/4368758/normal_5f91767b2b5ef.pdf, https://cdn-cms.f-static.net/uploads/4417526/normal_5fadfed7effa0.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://trafficel.ru/wb?keyword=pdf%20standard%20beta%20distribution
- https://cdn-cms.f-static.net/uploads/4368758/normal_5f91767b2b5ef.pdf
- https://s3.amazonaws.com/tibitexil/whirlpool_designer_style_refrigerator_manual.pdf
- https://cdn-cms.f-static.net/uploads/4417526/normal_5fadfed7effa0.pdf
- https://s3.amazonaws.com/baxunaf/battle_cats_hacked_emulator_pc.pdf
- https://cdn-cms.f-static.net/uploads/4365563/normal_5f87122a5052e.pdf
- https://saxibodusazo.weebly.com/uploads/1/3/0/7/130740440/nedovi-nidobufina.pdf
- https://uploads.strikinglycdn.com/files/70526829-a2c5-4cb6-8cf1-4a58496a9eb0/23518661073.pdf
- https://uploads.strikinglycdn.com/files/11667995-aa08-459f-9067-a583127898ca/44740364732.pdf
- https://cdn-cms.f-static.net/uploads/4403820/normal_5f957beda40c9.pdf
- https://s3.amazonaws.com/fikuvine/56050424879.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- trafficel.ru
- cdn-cms.f-static.net
- s3.amazonaws.com
- saxibodusazo.weebly.com
- uploads.strikinglycdn.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report