MALICIOUS — 7038966.pdf

MALICIOUS — 7038966.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: d7d704cb76ac4431c41034e5d2bf8694bb63f73de85b62ca71de9f938ef7d2c7
• SHA-1: 0413a4cf30b9fb717c90527f57a25042843101ff
• MD5: 1d5ea2cf8369327b0e3ca9dc5066178c
• ssdeep: 1536:O5Hteh/5lZzDvMZg2lr9TYy1Yn1GTGaPTaE7IsY1J3mc55:mSxbzqB7TYy15Ta+IlT3my
• TLSH: T13736D0F35183DD5C7645AF177BBB282CB15AD0CC122296B494C87ABCC9B81BE7E10852
• Submitted as: 7038966.pdf
• File type: pdf · Size: 66391 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafftec.ru/wb?keyword=pandora%20app%20download%20windows%2010, https://uploads.strikinglycdn.com/files/460543d8-9a5b-460f-8637-960fdce17101/47768021388.pdf, https://wadozivapo.weebly.com/uploads/1/3/4/5/134512268/mulivanibeluwe_lirozunonug_bovomesaf.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafftec.ru/wb?keyword=pandora%20app%20download%20windows%2010
• https://uploads.strikinglycdn.com/files/460543d8-9a5b-460f-8637-960fdce17101/47768021388.pdf
• https://wadozivapo.weebly.com/uploads/1/3/4/5/134512268/mulivanibeluwe_lirozunonug_bovomesaf.pdf
• https://uploads.strikinglycdn.com/files/d8cc98b1-6942-4c76-abe1-8e13d7705a4b/jomegekodutugup.pdf
• https://cdn-cms.f-static.net/uploads/4385207/normal_5f8c388962b3e.pdf
• https://uploads.strikinglycdn.com/files/ac5540ea-088b-4b98-ab03-c96276060b49/84088463210.pdf
• https://s3.amazonaws.com/loxopudizus/insert_youtube_video_into_google_slides.pdf
• https://s3.amazonaws.com/divexikav/wirel.pdf
• https://s3.amazonaws.com/vasofirida/18724844292.pdf
• https://s3.amazonaws.com/jeworurowam/me_and_the_key_2_level_22.pdf
• https://s3.amazonaws.com/zaxuledo/wixewovufusodi.pdf
• https://s3.amazonaws.com/divelatoxa/18893041583.pdf
• https://s3.amazonaws.com/baxadelefofibuz/indian_main_door_design_catalogue.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafftec.ru
• uploads.strikinglycdn.com
• wadozivapo.weebly.com
• cdn-cms.f-static.net
• s3.amazonaws.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report