MALICIOUS — normal_5f8705609d542.pdf

MALICIOUS — normal_5f8705609d542.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: e849c7bbbb5797320788ca58f4f4b8edae4747244d28c48f52ecfd3e1fcfca10
SHA-1: dbedb413be0783faf4debe4f201875919a3379a9
MD5: a5246395e43e08aebd89f02d90732681
ssdeep: 1536:AGF8eB7DdBK5A4Bw7Yeb6My62hPWHQ7ksMz:NF8eXgW5seb6T62hF7k9
TLSH: T18734AFF3515BDE8C7AC7E743A9AB1158649AC78D2037AB905484B76CC4BC2BDAF40D20
Submitted as: normal_5f8705609d542.pdf
File type: pdf · Size: 55284 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gettraff.ru/123?keyword=nclex+review+apps+for+android, https://cdn-cms.f-static.net/uploads/4365656/normal_5f8703bb66e18.pdf, https://cdn-cms.f-static.net/uploads/4366033/normal_5f86f67fa867b.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://gettraff.ru/123?keyword=nclex+review+apps+for+android
https://cdn-cms.f-static.net/uploads/4365656/normal_5f8703bb66e18.pdf
https://cdn-cms.f-static.net/uploads/4366033/normal_5f86f67fa867b.pdf
https://cdn-cms.f-static.net/uploads/4366004/normal_5f87020322abb.pdf
https://cdn-cms.f-static.net/uploads/4365591/normal_5f86fe7a71890.pdf
https://uploads.strikinglycdn.com/files/d1073b8a-b387-4936-b75f-0d31f728d466/vireribowimalowifabopup.pdf
https://uploads.strikinglycdn.com/files/c8fb817a-b998-4c81-8094-426a1b5b477b/268054124.pdf
https://cdn-cms.f-static.net/uploads/4366031/normal_5f86f5df71933.pdf
https://cdn-cms.f-static.net/uploads/4365656/normal_5f87041fb1b86.pdf
https://cdn-cms.f-static.net/uploads/4366004/normal_5f86ff8d618b6.pdf
https://site-1036805.mozfiles.com/files/1036805/tidiwosorakeri.pdf
https://site-1042779.mozfiles.com/files/1042779/fikobifabiko.pdf
https://site-1039804.mozfiles.com/files/1039804/ladokogali.pdf
https://site-1039529.mozfiles.com/files/1039529/97253384627.pdf
https://jawasolasazilem.weebly.com/uploads/1/3/1/3/131379174/sefaritonos-nukivafeka-retisebop-regaxumex.pdf
https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/wirexanusir.pdf
https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/1a27643b41869.pdf
https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/7775416.pdf
https://site-1048162.mozfiles.com/files/1048162/21950150191.pdf
https://site-1042666.mozfiles.com/files/1042666/4673873888.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

gettraff.ru
cdn-cms.f-static.net
uploads.strikinglycdn.com
site-1036805.mozfiles.com
site-1042779.mozfiles.com
site-1039804.mozfiles.com
site-1039529.mozfiles.com
jawasolasazilem.weebly.com
fijojonibiw.weebly.com
zoxuzuxebexot.weebly.com
jakedekokobara.weebly.com
site-1048162.mozfiles.com
site-1042666.mozfiles.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report