MALICIOUS — a7a812e723982.pdf

MALICIOUS — a7a812e723982.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: e0946859f62e4d22d7859ff82ec5033e8bddf00941a589d919ef4addb95e27da
• SHA-1: 890933bbc703904a983ddac37c8599923e8104fd
• MD5: 98a4f2e3e1d78c4cc3ac2ebc94284f91
• ssdeep: 1536:Uf9rm3EhjNTq2dqJCndW7exIVYCWfy9Wo2FL2ejNXNOd24IC:0NhJq2dqJdbodLpZNOd2A
• TLSH: T1B636E2F352DBED4C7689AB53B9EB225DB049CA847823A6B40488766CC4FC27D6D14F10
• Submitted as: a7a812e723982.pdf
• File type: pdf · Size: 68220 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffset.ru/wb?keyword=aadat%20se%20majboor%20movie%20song, https://uploads.strikinglycdn.com/files/c2c69ac6-b001-4e34-a0c7-6a0e930f8fc8/read_the_book_smile_online_for_free.pdf, https://uploads.strikinglycdn.com/files/f91ec5ed-5f59-416d-966f-d498b7754088/skeleton_waiting_for_approval_meme.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffset.ru/wb?keyword=aadat%20se%20majboor%20movie%20song
• https://uploads.strikinglycdn.com/files/c2c69ac6-b001-4e34-a0c7-6a0e930f8fc8/read_the_book_smile_online_for_free.pdf
• https://uploads.strikinglycdn.com/files/f91ec5ed-5f59-416d-966f-d498b7754088/skeleton_waiting_for_approval_meme.pdf
• https://fuparududewon.weebly.com/uploads/1/3/1/8/131856041/7b2d4f92db403.pdf
• https://uploads.strikinglycdn.com/files/895c71ac-61f5-4b6f-8b23-68fc93ca40de/free_2012_jeep_compass_repair_manual.pdf
• https://uploads.strikinglycdn.com/files/1161cdf6-5b46-49ef-a2ca-9df19b3a5f5a/33954139210.pdf
• https://uploads.strikinglycdn.com/files/69bb1d0b-faa2-45ab-a08e-9dda1b1a496d/talojekobuta.pdf
• https://uploads.strikinglycdn.com/files/46f6640d-01c4-4afd-99bf-7bb1aaaf24b7/cave_story_charcoal.pdf
• https://cdn-cms.f-static.net/uploads/4374540/normal_5fa84c98bbaf6.pdf
• https://cdn-cms.f-static.net/uploads/4370073/normal_5fa09ef883c20.pdf
• https://uploads.strikinglycdn.com/files/e8874831-58e3-4edb-bac8-c167673e4bb0/29838121428.pdf
• https://cdn-cms.f-static.net/uploads/4491665/normal_5fb4079a575bd.pdf
• https://uploads.strikinglycdn.com/files/64604940-bc2c-4fd1-8aaf-eba1bc687300/75686825207.pdf
• https://cdn-cms.f-static.net/uploads/4365606/normal_5fa0bc7b84641.pdf
• https://bijifejutumaxob.weebly.com/uploads/1/3/1/3/131381781/guruvakokowin_rixoriwezukomor_pepuw_mogovife.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffset.ru
• uploads.strikinglycdn.com
• fuparududewon.weebly.com
• cdn-cms.f-static.net
• bijifejutumaxob.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report