MALICIOUS — normal_5fb92df489a6c.pdf

MALICIOUS — normal_5fb92df489a6c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: e1742e4102bab34c171534c4ada10a6ae02bb71ae0a1d6ff238070b25262c061
• SHA-1: e3934e2bda1f35cf83240dfb36edcf990d3f156c
• MD5: 7a50402f82da4e67fdf642bb57157d0f
• ssdeep: 1536:5F1c4wZfljX/kIxxOs7OimXxOdYUeP20rY4TjDLbVxwOLKAmz2GPD7WlSKclrqI:X1cJzrxOI9mXwdYUboY4PDLByzJPD4Rc
• TLSH: T15F38E1B370D7CC4CB64BAF23AAB71468588ADB857022DFA01084761CE17C2FD5E15E51
• Submitted as: normal_5fb92df489a6c.pdf
• File type: pdf · Size: 82677 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://cctraff.ru/123?utm_term=tar+heels+women%2527s+basketball+schedule, https://cdn-cms.f-static.net/uploads/4367297/normal_5fa80e6a9e7c8.pdf, https://cdn-cms.f-static.net/uploads/4366042/normal_5f86fffbd83d3.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/123?utm_term=tar+heels+women%2527s+basketball+schedule
• https://cdn-cms.f-static.net/uploads/4367297/normal_5fa80e6a9e7c8.pdf
• https://cdn-cms.f-static.net/uploads/4366042/normal_5f86fffbd83d3.pdf
• https://cdn-cms.f-static.net/uploads/4374521/normal_5f89d1c414960.pdf
• https://cdn-cms.f-static.net/uploads/4383460/normal_5fa84565c0782.pdf
• https://uploads.strikinglycdn.com/files/b64ebfcf-90e1-411a-86f1-911d47b452c1/sofokiparoxef.pdf
• https://cdn-cms.f-static.net/uploads/4404725/normal_5f95f1d527ba1.pdf
• https://cdn-cms.f-static.net/uploads/4366627/normal_5fadab8a09cde.pdf
• https://s3.amazonaws.com/labitajaxatufib/sawuwuvoketulenosedabi.pdf
• https://cdn-cms.f-static.net/uploads/4393345/normal_5f9f135b23541.pdf
• https://cdn-cms.f-static.net/uploads/4444351/normal_5fb7ec8c2ce2c.pdf
• https://jufopikigon.weebly.com/uploads/1/3/4/3/134309667/bijedaboduw.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• cdn-cms.f-static.net
• uploads.strikinglycdn.com
• s3.amazonaws.com
• jufopikigon.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report