MALICIOUS — normal_5fc7535aa006e.pdf

MALICIOUS — normal_5fc7535aa006e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.

Identification

• SHA-256: ec884b75f07370d33da444f02419a57b9877fa3f51dab906165528f0302d6ac6
• SHA-1: af1b841967e471641a0d239a2120cbfadb24bae7
• MD5: d04816b36d01fa4712ab1d27779f10c3
• ssdeep: 1536:ZKDM1V4drxziguWhKzG0AHK1AjCw2gVKvHpICLlU3KACcj7FBrMfxGX:PVYrhiffK0ZBPwSAKE7fME
• TLSH: T1173AE1F3B1E7EE0C79C7AF473D7228582185C78C7032A7640485BA6DC1785AEAE60D52
• Submitted as: normal_5fc7535aa006e.pdf
• File type: pdf · Size: 94782 bytes
• Verdict: malicious (92/100)

Detections (5 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Microsoft Defender: Trojan:PDF/Phish!atmn
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafffe.ru/123?utm_term=speed+of+light+in+calculus, https://sadodirovi.weebly.com/uploads/1/3/4/8/134888529/wunufesij.pdf, https://static1.squarespace.com/static/5fc1015360f2895dc1e86a3c/t/5fc46e435147b14804c0bbde/1606708804602/airbrush_compressor_with_tank_canada.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://trafffe.ru/123?utm_term=speed+of+light+in+calculus
• https://sadodirovi.weebly.com/uploads/1/3/4/8/134888529/wunufesij.pdf
• https://static1.squarespace.com/static/5fc1015360f2895dc1e86a3c/t/5fc46e435147b14804c0bbde/1606708804602/airbrush_compressor_with_tank_canada.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf6bda08845d0924832976/1606380506885/what_does_a_tree_octopus_eat.pdf
• https://fiwadevu.weebly.com/uploads/1/3/4/5/134592392/4154781.pdf
• https://s3.amazonaws.com/robumuduluwise/jamujemokuzilesewetol.pdf
• https://xojerajap.weebly.com/uploads/1/3/1/3/131384359/3373854.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdee593f75b1664399f180/1606282892363/83293418756.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4b5fe18c5c478ef216b6/1606372191643/opera_apk_mod.pdf
• https://static1.squarespace.com/static/5fc0dda31452f90b7fe53205/t/5fc114569b1ed0353801db74/1606489175027/lajuzawuduno.pdf
• https://s3.amazonaws.com/vavebufevodutob/26228313741.pdf
• https://s3.amazonaws.com/luropi/71475292956.pdf
• https://s3.amazonaws.com/rerinago/91312455427.pdf
• https://s3.amazonaws.com/gofiguj/vodopud.pdf
• https://s3.amazonaws.com/kelageketisefuv/skoda_karoq_se_l_manual.pdf
• https://static1.squarespace.com/static/5fc2a394239b0722913c6c92/t/5fc451513570fb44d18ccadd/1606701394491/wow_engineering_motorcycle_mount_recipe.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafffe.ru
• sadodirovi.weebly.com
• static1.squarespace.com
• fiwadevu.weebly.com
• s3.amazonaws.com
• xojerajap.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report