MALICIOUS — padax.pdf

MALICIOUS — padax.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 52 detection engines flagged it.

Identification

• SHA-256: f0fcf3325f186f5bdb67323038af9ea598388cebc79608a9e71f6ed726079dd1
• SHA-1: 5278da39aa896ec90e0688a7b4df9ca0d2eb5359
• MD5: 8a049be201c5f7cc2ccd2e73bfad36d6
• ssdeep: 768:TgGzpDCmYbANNnWnYosOoOBRRsaKc18HV0dqyTFU7BJUhIHmQ5Z4:sGF2deOloav18HV0dq6eJzmQn4
• TLSH: T197329DF310A7DD8CBA86DB035EAE299DA185D748B173D76024D8372D84BC3BDAE40560
• Submitted as: padax.pdf
• File type: pdf · Size: 47534 bytes
• Verdict: malicious (88/100)

Detections (3 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=infarction+pathology+pdf, http://files.hillsboroupc.com/uploads/1/3/0/7/130740586/5941942.pdf, http://files.evansclass.com/uploads/1/3/2/7/132741709/goxaxiburuveto_veruv_xulufisejipogab.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=infarction+pathology+pdf
• http://files.hillsboroupc.com/uploads/1/3/0/7/130740586/5941942.pdf
• http://files.evansclass.com/uploads/1/3/2/7/132741709/goxaxiburuveto_veruv_xulufisejipogab.pdf
• http://sudiz.thelearningrunner.com/uploads/1/3/0/8/130814355/7304836.pdf
• http://sujodej.myhoosierhearth.com/uploads/1/3/2/6/132681361/kazogavimurujowik.pdf
• http://files.guideturisticheancona.com/uploads/1/3/1/1/131164063/nelumumonedes.pdf
• https://uploads.strikinglycdn.com/files/cb10e268-d164-404d-857d-6188849b872d/84115796220.pdf
• https://uploads.strikinglycdn.com/files/cbe1e07e-3ddd-44ce-84ee-33995f0acbb7/36901259104.pdf
• https://uploads.strikinglycdn.com/files/ae0c25ac-89cd-4373-a4fa-257387d5712d/918079735.pdf
• https://uploads.strikinglycdn.com/files/a524d3d0-d7fe-4d84-9e1f-ec0c0c19fb4e/8410323726.pdf
• https://uploads.strikinglycdn.com/files/af110dc0-18c1-4446-8c09-46e78786ff9c/navekamemikubuwid.pdf
• http://zodexu.kninecouture.com/uploads/1/3/1/6/131637136/bdcbb5e4.pdf
• http://files.canadoretv.com/uploads/1/3/1/1/131164273/faxomutut.pdf
• http://xezumu.drkimberlycharper.com/uploads/1/3/1/8/131856408/7117213.pdf
• http://bukesawub.restorerevive360.com/uploads/1/3/1/4/131482993/lixul.pdf
• http://varijaw.bolingbrookhistprescomm.org/uploads/1/3/0/8/130813979/fca32d6a.pdf
• https://site-1037219.mozfiles.com/files/1037219/pesozaxa.pdf
• https://site-1036637.mozfiles.com/files/1036637/gebobotopezevapupisamodav.pdf
• https://site-1037922.mozfiles.com/files/1037922/xeturanuwijefukow.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• files.hillsboroupc.com
• files.evansclass.com
• sudiz.thelearningrunner.com
• sujodej.myhoosierhearth.com
• files.guideturisticheancona.com
• uploads.strikinglycdn.com
• zodexu.kninecouture.com
• files.canadoretv.com
• xezumu.drkimberlycharper.com
• bukesawub.restorerevive360.com
• varijaw.bolingbrookhistprescomm.org
• site-1037219.mozfiles.com
• site-1036637.mozfiles.com
• site-1037922.mozfiles.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report