MALICIOUS — dcc11b_e183284d869b4976b4b7b49d372bc732.pdf

MALICIOUS — dcc11b_e183284d869b4976b4b7b49d372bc732.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 011ac636c270ca7e43e136758e3113b05e759ab648ddfe082dbcc65eb57fc7c5
• SHA-1: 5c099823853b0ce2e5502cb71e57f32ebff9504e
• MD5: 7149619ef71ebf674299015b977f14f3
• ssdeep: 768:ngGzpDqxBFclhWOOaObr1SeVTv2ievJq1BPvDUA7GcY6y7QMMzXSPFUb1NjQ:gGFmxfaOH1SC2ievJwPvYA6cY6y7QnzS
• TLSH: T1DD32B0F3445BDC4C754BAB03ADAB156569C6C68E5226D72008C83B6CDCBC2BDAF50931
• Submitted as: dcc11b_e183284d869b4976b4b7b49d372bc732.pdf
• File type: pdf · Size: 43910 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=raze+hacked+unblocked+76, https://cdn.shopify.com/s/files/1/0433/2670/1718/files/tratamiento_de_absceso_hepatico_piogeno.pdf, https://cdn.shopify.com/s/files/1/0433/0687/7080/files/jewepogepavab.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=raze+hacked+unblocked+76
• https://cdn.shopify.com/s/files/1/0433/2670/1718/files/tratamiento_de_absceso_hepatico_piogeno.pdf
• https://cdn.shopify.com/s/files/1/0433/0687/7080/files/jewepogepavab.pdf
• https://cdn.shopify.com/s/files/1/0427/5650/5756/files/abbreviation_worksheets.pdf
• https://cdn.shopify.com/s/files/1/0430/1130/9719/files/polasisi.pdf
• http://files.meganbledsoeward.com/uploads/1/3/0/7/130775265/1123404.pdf
• http://riluz.js411sa.org/uploads/1/3/2/6/132696056/juxibikomer.pdf
• http://pafubesel.alexandrahaleyart.com/uploads/1/3/0/8/130874679/2381894.pdf
• https://d522f603-8341-4957-8ca8-22daf348534a.filesusr.com/ugd/eb6612_861f506771ef46f383022850a081eeb6.pdf?index=true
• https://574f4f87-acbc-4a16-b74d-9f7f4bec16bb.filesusr.com/ugd/610d21_fbed94e43cad498d8611ec1bb1b93314.pdf?index=true
• https://c288df73-8656-4f24-a0a7-1c9c69ac61be.filesusr.com/ugd/2994dd_477fd5f9c2e343eeb1cffc35ac4378f9.pdf?index=true
• https://4af0a01b-7cbc-4e2e-856e-cbe8ecd02381.filesusr.com/ugd/18f527_3d02f6ef78ae46ad9000f6d857408126.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• files.meganbledsoeward.com
• riluz.js411sa.org
• pafubesel.alexandrahaleyart.com
• d522f603-8341-4957-8ca8-22daf348534a.filesusr.com
• 574f4f87-acbc-4a16-b74d-9f7f4bec16bb.filesusr.com
• c288df73-8656-4f24-a0a7-1c9c69ac61be.filesusr.com
• 4af0a01b-7cbc-4e2e-856e-cbe8ecd02381.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report