MALICIOUS — normal_5faa3a7d49453.pdf

MALICIOUS — normal_5faa3a7d49453.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: ee4f86656096e02fc40070d554ecc4eb98d0fcfde49f4328c7b3666efbecc775
• SHA-1: 6bd10f1b31b9b3f3a555f1731ab038ae50e1e7a6
• MD5: 0da3c22856e60c3a23fc860d572b620e
• ssdeep: 1536:KY7ffhlvHhLF216m6doMW3TK2O0kLfdK27uqIT:L7fplvHho1R6doL3W2O0jYuV
• TLSH: T10E37D0F3A197DCCCB681AF4379EA69383486D5543932AD6548C0BB6CC0B83FDAD15A40
• Submitted as: normal_5faa3a7d49453.pdf
• File type: pdf · Size: 75151 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffine.ru/123?keyword=cold+war+worksheet+printable, https://xalipifizipig.weebly.com/uploads/1/3/1/3/131379045/8595799.pdf, https://jarapitoxedomel.weebly.com/uploads/1/3/1/4/131437170/1cf471c3.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffine.ru/123?keyword=cold+war+worksheet+printable
• https://s3.amazonaws.com/pewebopufupe/11414489486.pdf
• https://xalipifizipig.weebly.com/uploads/1/3/1/3/131379045/8595799.pdf
• https://jarapitoxedomel.weebly.com/uploads/1/3/1/4/131437170/1cf471c3.pdf
• https://s3.amazonaws.com/subud/423101639.pdf
• https://uploads.strikinglycdn.com/files/1f10da3b-dc58-4c25-b23b-25e6c8dcb86b/78642223957.pdf
• https://nidobafimenute.weebly.com/uploads/1/3/4/5/134526671/fegilakofutifelaj.pdf
• https://uploads.strikinglycdn.com/files/db64a9e5-2c68-41d2-b04a-e21ef2ddc026/proposition_subordonne_conjonctive_complment_circonstanciel_de_temps.pdf
• https://s3.amazonaws.com/wiwuxot/ninja_cat_google_sites_unblocked.pdf
• https://s3.amazonaws.com/jenagubadopi/admissibility_of_forensic_evidence_in_india.pdf
• https://s3.amazonaws.com/tojazudibumogab/fishing_reels_discounted.pdf
• https://s3.amazonaws.com/mewezekilafef/14517993556.pdf
• https://uploads.strikinglycdn.com/files/0119ce6a-822b-4e0f-975a-ec6052b39265/95728012367.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffine.ru
• s3.amazonaws.com
• xalipifizipig.weebly.com
• jarapitoxedomel.weebly.com
• uploads.strikinglycdn.com
• nidobafimenute.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report