MALICIOUS — 3767001.pdf

MALICIOUS — 3767001.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 4 of 50 detection engines flagged it.

Identification

• SHA-256: fd214c71ec2a246d88c9414bb9bdf57bef3ab5e0a74e69b0c6a88d4c7861dabf
• SHA-1: 57866f62c5cb635376e735760b8141c903bae4d4
• MD5: ab3e0f87b6433bd66ae2354f29b36242
• ssdeep: 1536:e3Dzk6w/Qpal/8eKjqEubxE2OUbgrelvppp5v:Co6w/Qpa8j6TBMuN
• TLSH: T10F36DFF3A187DE8CBF871F176CB71029B089E68E653287646448763CC5BC55CB910A42
• Submitted as: 3767001.pdf
• File type: pdf · Size: 67661 bytes
• Verdict: malicious (92/100)

Detections (4 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen

Why this verdict

The malicious score of 92/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: https://traffine.ru/wb?keyword=free%20printable%20world%20map%20pdf, https://foroziroxodom.weebly.com/uploads/1/3/4/6/134647192/5714ac9f17ce1.pdf, https://naxizugopigonav.weebly.com/uploads/1/3/1/4/131408516/nedav-fukew-jerifolad.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://traffine.ru/wb?keyword=free%20printable%20world%20map%20pdf
• https://foroziroxodom.weebly.com/uploads/1/3/4/6/134647192/5714ac9f17ce1.pdf
• https://s3.amazonaws.com/susopuzupure/96308977967.pdf
• https://naxizugopigonav.weebly.com/uploads/1/3/1/4/131408516/nedav-fukew-jerifolad.pdf
• https://s3.amazonaws.com/sesafefanulokam/tower_defense_zone_2_mod_apk.pdf
• https://s3.amazonaws.com/wilugugo/11841711788.pdf
• https://jaxuwigoba.weebly.com/uploads/1/3/4/2/134266140/21f56645.pdf
• https://vuwurata.weebly.com/uploads/1/3/4/4/134481670/voxuledo.pdf
• https://s3.amazonaws.com/xugigabitulu/sudukugezivere.pdf
• https://s3.amazonaws.com/sifawekujiki/moviesda_2017_telugu_movies.pdf
• https://reruwezoketa.weebly.com/uploads/1/3/4/5/134503250/rukuminawud_bagonaz.pdf
• https://wokusozevopiwaj.weebly.com/uploads/1/3/4/3/134381386/7486083.pdf
• https://s3.amazonaws.com/voropa/sapixalubizofevozegi.pdf
• https://buxiwizekekaxe.weebly.com/uploads/1/3/4/6/134662233/kekaxevob-lotarenibux.pdf
• https://cdn-cms.f-static.net/uploads/4391024/normal_5f97352f248b3.pdf
• https://kutesavakelex.weebly.com/uploads/1/3/4/3/134336058/2354aff.pdf
• https://rupulosulokor.weebly.com/uploads/1/3/4/7/134773135/tapatepevis.pdf
• https://xepebujusu.weebly.com/uploads/1/3/4/3/134319702/mixibexupo.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• traffine.ru
• foroziroxodom.weebly.com
• s3.amazonaws.com
• naxizugopigonav.weebly.com
• jaxuwigoba.weebly.com
• vuwurata.weebly.com
• reruwezoketa.weebly.com
• wokusozevopiwaj.weebly.com
• buxiwizekekaxe.weebly.com
• cdn-cms.f-static.net
• kutesavakelex.weebly.com
• rupulosulokor.weebly.com
• xepebujusu.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report