MALICIOUS — normal_5fca4048b4d3e.pdf

MALICIOUS — normal_5fca4048b4d3e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: f570dcf240963533634bfbb964b49b00f9d8c2d1e82e27fa72c21c589a3dfc70
• SHA-1: af23555e7ea3a610afa0b9150ad2704cff415f06
• MD5: 05ab02b1ad7c77a83c24217c4c3d06d4
• ssdeep: 1536:UtmW5oSqvlRtBdaavY//HLmE3YPz9QGuzHDKF/dcOXc:9S+jtB0t/fLmCYIzjadcH
• TLSH: T1A836CFF3A09BCCDC7A8D97477EF60518108AD3993172ABE44588773CC9782BD6E20A50
• Submitted as: normal_5fca4048b4d3e.pdf
• File type: pdf · Size: 64662 bytes
• Verdict: malicious (92/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://gettraff.ru/123?utm_term=lean+in+15+shift+plan+pdf, https://static1.squarespace.com/static/5fc10a34403f5353fd968438/t/5fc776d41d689b68bf9d1def/1606907604845/letepagut.pdf, https://uploads.strikinglycdn.com/files/45abb4df-b7ea-4753-8a71-c1d93993926a/frackin_universe_storage.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/123?utm_term=lean+in+15+shift+plan+pdf
• https://static1.squarespace.com/static/5fc10a34403f5353fd968438/t/5fc776d41d689b68bf9d1def/1606907604845/letepagut.pdf
• https://uploads.strikinglycdn.com/files/45abb4df-b7ea-4753-8a71-c1d93993926a/frackin_universe_storage.pdf
• https://cdn-cms.f-static.net/uploads/4489609/normal_5fafaa5c1792d.pdf
• https://uploads.strikinglycdn.com/files/ebd8b6e5-0268-43dc-b4ee-7d10853ece76/diduvonudimisa.pdf
• https://cdn-cms.f-static.net/uploads/4403121/normal_5fc1f77c26284.pdf
• https://uploads.strikinglycdn.com/files/92ff5f28-c2f5-4823-8eb7-04cb0454b044/kuwugapobo.pdf
• https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf654b145a8629dca925ce/1606378827703/mtg_arena_installer_ended_prematurely.pdf
• https://static1.squarespace.com/static/5fc0f1dfe9fc3622d5225d5f/t/5fc15fc12dd96f591822d512/1606508481812/mens_polo_boots_size_13.pdf
• https://uploads.strikinglycdn.com/files/7f982e4c-b7b2-4e0a-9d2c-87b4d0b4a198/sven_og_hans_uendelige_mange_lektier.pdf
• https://uploads.strikinglycdn.com/files/3d5e4c19-26fb-4405-8b39-c2c79a5f35d5/wasosirof.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• static1.squarespace.com
• uploads.strikinglycdn.com
• cdn-cms.f-static.net
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report