MALICIOUS — normal_5fe05227f34c0.pdf

MALICIOUS — normal_5fe05227f34c0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: f20280b53c04f5a217ea84fdb555b85784af498b15ee4e9a1b3ca332bba20291
• SHA-1: 876a121e2c3bae443891327d47ee8806befeb2a6
• MD5: dc3f8e5064e4f9f8d44bc5d0b047bc96
• ssdeep: 1536:98aIyjaut941clp+IEdOVG9tuEKRvDwIThAE4o2G3F6cS2u:LIKaW41clp+dYYmHvDwaAc2QF6c2
• TLSH: T15F39E0F3205BCD586545CF5B7BAB29697086A68D7021D33848CC3B6CD6B8BBDAE10C14
• Submitted as: normal_5fe05227f34c0.pdf
• File type: pdf · Size: 90833 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://trafficel.ru/123?utm_term=9th+grade+physical+science+books, https://static1.squarespace.com/static/5fc5947b0b6b03258f5520ec/t/5fcae869393ce47356295d0f/1607133289862/osrs_wyvern_slayer_guide.pdf, https://gemaxudemaxepeb.weebly.com/uploads/1/3/1/0/131070646/kolifinakuwe_vizitewinagaja_sesidugonav.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• https://trafficel.ru/123?utm_term=9th+grade+physical+science+books
• https://s3.amazonaws.com/vukujidor/rotexili.pdf
• https://static1.squarespace.com/static/5fc5947b0b6b03258f5520ec/t/5fcae869393ce47356295d0f/1607133289862/osrs_wyvern_slayer_guide.pdf
• https://gemaxudemaxepeb.weebly.com/uploads/1/3/1/0/131070646/kolifinakuwe_vizitewinagaja_sesidugonav.pdf
• https://s3.amazonaws.com/bupaxomu/95616619319.pdf
• https://s3.amazonaws.com/luborinizu/active_option_contract_meaning_tx.pdf
• https://dolujete.weebly.com/uploads/1/3/4/6/134674842/junokej_zadawekobex_tetugofofefu_gawapolupenoro.pdf
• https://cdn-cms.f-static.net/uploads/4365656/normal_5f9a6e239306f.pdf
• https://s3.amazonaws.com/fojaxexino/26147293906.pdf
• https://static1.squarespace.com/static/5fc6899cc6d96458364908ac/t/5fc76e5b56cd4459b3b8c602/1606905454009/92688183968.pdf
• https://s3.amazonaws.com/vigevot/eeoc_intake_questionnaire.pdf
• https://s3.amazonaws.com/fajixe/google_phishing_email_report.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• trafficel.ru
• s3.amazonaws.com
• static1.squarespace.com
• gemaxudemaxepeb.weebly.com
• dolujete.weebly.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report