MALICIOUS — normal_5fca15759cd67.pdf
MALICIOUS — normal_5fca15759cd67.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f15e54acefc5f01e34a4f09f058a3d59560757ad37b622966527bcf69e88924f - SHA-1:
3d75e7534ccb5c70bc6c112679021d32661fb9bd - MD5:
4105a7d2f4c6cf15c76029af73bce909 - ssdeep:
1536:H2RK92MBF1+MRcseGUYEpCn/f5ddGYEuh2xz6+sOU9:SK92MvEMR8GIonhGYNh2dG - TLSH:
T15936E1F32097DE8C7182A3036AEA5469B159D38C7537EF6848D4B12DC4B82ED7F60A41 - Submitted as: normal_5fca15759cd67.pdf
- File type: pdf · Size: 67654 bytes
- Verdict: malicious (94/100)
Detections (4 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
MITRE ATT&CK
Why this verdict
The malicious score of 94/100 is the fusion of 5 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule
Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95 - Embedded link rated suspicious by URL analysis: https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe367a1972c46e3c6a067b/1606301307558/6123841303.pdf - network signal, weight 0.40, confidence 0.60
- Embedded network infrastructure: https://traffking.ru/123?utm_term=minecraft+pe+windows+10+apk+free, https://cdn-cms.f-static.net/uploads/4373526/normal_5f9a1a68c3e26.pdf, https://uploads.strikinglycdn.com/files/f5fbfde3-f348-4adc-bd90-a23e22493fef/vupuzonod.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://traffking.ru/123?utm_term=minecraft+pe+windows+10+apk+free
- https://s3.amazonaws.com/tenunud/mopanazotepuzan.pdf
- https://cdn-cms.f-static.net/uploads/4373526/normal_5f9a1a68c3e26.pdf
- https://s3.amazonaws.com/nimuwet/sekuv.pdf
- https://uploads.strikinglycdn.com/files/f5fbfde3-f348-4adc-bd90-a23e22493fef/vupuzonod.pdf
- https://uploads.strikinglycdn.com/files/e0918f58-92d7-40b5-ad4e-aa7fbde35309/doom_3_pc_walkthrough.pdf
- https://s3.amazonaws.com/joterige/half_hitch_fishing_report_panama_city.pdf
- https://uploads.strikinglycdn.com/files/ea0ce06c-f5e4-4c3e-99f5-8aeb7ba61d88/zadinufef.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe367a1972c46e3c6a067b/1606301307558/6123841303.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd148532780c533aaa78ae/1606227078939/8990091384.pdf
- https://uploads.strikinglycdn.com/files/01a32762-d988-4254-a414-a5b0c31a05f3/3428178064.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd055bedabee7b440869d5/1606223195778/transplant_surgeon_salary_2019.pdf
- https://wisolowiguwo.weebly.com/uploads/1/3/4/6/134630140/terejudinob-digegurida-tixofabigi-ganokuxapasejaz.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- traffking.ru
- s3.amazonaws.com
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- static1.squarespace.com
- wisolowiguwo.weebly.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report