MALICIOUS — normal_5fad71c78f9d6.pdf

MALICIOUS — normal_5fad71c78f9d6.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: d5e585fdc2d6d463a16137bfab90199d525ebd3074237190121a940d12fedf08
• SHA-1: 1e944f5e1bb40ef15bc81b9085f8439663124033
• MD5: 0d591a469515dc528d309b6acf437a63
• ssdeep: 1536:yQ2V9jz3qsv38I7lFa9aAA4S6PoIgu3rzwCfmJMiBEwXS:OV9SG3f7lFa93A4Skgyrz/NsER
• TLSH: T16536D0F36297DCCCBA85AB47A8E65018A449C68D2136CB444485B71DD8BC3BD6F14FA0
• Submitted as: normal_5fad71c78f9d6.pdf
• File type: pdf · Size: 69611 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafffi.ru/123?utm_term=rv+propane+regulator+walmart, https://witudaki.weebly.com/uploads/1/3/4/3/134332653/c5b343.pdf, https://welavofewefose.weebly.com/uploads/1/3/0/8/130813025/3729972.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://trafffi.ru/123?utm_term=rv+propane+regulator+walmart
• https://witudaki.weebly.com/uploads/1/3/4/3/134332653/c5b343.pdf
• https://welavofewefose.weebly.com/uploads/1/3/0/8/130813025/3729972.pdf
• https://uploads.strikinglycdn.com/files/b34bd6c3-6f2b-4853-ae67-85c513826aa0/69178781192.pdf
• https://uploads.strikinglycdn.com/files/9e8a982d-829b-4f4c-a877-3a9690d76131/pulepasare.pdf
• https://uploads.strikinglycdn.com/files/ba92d925-6237-489a-bedf-3a9d068497de/amazon_vendor_compliance_guide.pdf
• https://cdn-cms.f-static.net/uploads/4382429/normal_5fa02fc01df71.pdf
• https://s3.amazonaws.com/lupuvogotog/kuziw.pdf
• https://s3.amazonaws.com/ditiruz/68690328598.pdf
• https://kawuloxegulul.weebly.com/uploads/1/3/4/3/134389306/e6c737.pdf
• https://jidamusalaf.weebly.com/uploads/1/3/4/3/134378250/3010393.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffi.ru
• witudaki.weebly.com
• welavofewefose.weebly.com
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• s3.amazonaws.com
• kawuloxegulul.weebly.com
• jidamusalaf.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report