MALICIOUS — fedf23_6d90a877249f4e8bae60f4f758c32bea.pdf

MALICIOUS — fedf23_6d90a877249f4e8bae60f4f758c32bea.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 027418a2c27894beb89878c39a3e5935e02ca851bebe3ff5cb696d5cdf672e43
• SHA-1: 6e61850992bcb4f64d6c6459369f649e36279e6e
• MD5: 7b7da8a53b9396305a57416fed7a2470
• ssdeep: 768:XgGzpD6soqxMaMT+RDQ9P8QpN1QadBNvKuKcAt+/j2BQxt34m4T:wGFGvCOT+RDQ9P8KvHSLcAt+/jd34m4T
• TLSH: T1DC31ADF35097EC8C768AAF176FEB11992585E2892122D66050CC776CC8BC2ECBF40670
• Submitted as: fedf23_6d90a877249f4e8bae60f4f758c32bea.pdf
• File type: pdf · Size: 42650 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=the+spiritual+essence+of+man+pdf, https://5e27d4e2-f35c-4a2d-8a48-bccce24b99ec.filesusr.com/ugd/9ea91e_2793e9cc8ed6474787f3721f80f890cd.pdf?index=true, https://76d74cd5-fceb-42b2-a8db-b82c6b99e9d4.filesusr.com/ugd/2f3216_29c713ac9b364e2a846f7ae9a1fd9b39.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=the+spiritual+essence+of+man+pdf
• https://5e27d4e2-f35c-4a2d-8a48-bccce24b99ec.filesusr.com/ugd/9ea91e_2793e9cc8ed6474787f3721f80f890cd.pdf?index=true
• https://76d74cd5-fceb-42b2-a8db-b82c6b99e9d4.filesusr.com/ugd/2f3216_29c713ac9b364e2a846f7ae9a1fd9b39.pdf?index=true
• https://8f015f00-93c7-4512-8169-39c189266fcf.filesusr.com/ugd/1cc777_8124ef30afd54c679f0870cfaebdf2b7.pdf?index=true
• https://dbef59a2-7900-4c35-8b34-5a0ccb087d77.filesusr.com/ugd/f6336d_d50bf00fe739426fadabf69b3017d774.pdf?index=true
• https://3679bca5-1a69-44b3-bbf7-b495a757294b.filesusr.com/ugd/3bcfef_14a0c80141d548e7bc5fb85a14158207.pdf?index=true
• https://2f62ba1c-d601-4fa8-8555-b6470f7ba64c.filesusr.com/ugd/4a2613_abfd4a6df2664f898db2a06c605b0b4d.pdf?index=true
• https://819086d6-e7d2-448b-9b89-aebbf5e7eb45.filesusr.com/ugd/a4c1fa_d8a2478229dc4ecfb0a47ee263b97710.pdf?index=true
• https://2d914652-ecd0-47fd-9aaa-a7846f837762.filesusr.com/ugd/405339_ec3632773d2e46589a7f4b0ab064068b.pdf?index=true
• https://b13ecb4b-ef23-4bae-87fd-3343e7b4e0d2.filesusr.com/ugd/d2751c_25840aff35cc47e29b9200be35965a5a.pdf?index=true
• https://9d6dd21d-9b51-49dd-86f1-0c6895ac356a.filesusr.com/ugd/bba345_f08c280537c64a6b83f037bbfa4afee3.pdf?index=true
• https://af591e4f-daaf-4685-a131-d67185808cb9.filesusr.com/ugd/312e0e_c4671e86dd664af89be82d5644024329.pdf?index=true
• https://26b34fd8-5e4e-4a3e-bfea-e1d5681bf8f2.filesusr.com/ugd/dcf311_dfcc6cb60d834e718fb75d14b693fad0.pdf?index=true
• https://7189949c-1110-4485-b771-9388a4fe6c39.filesusr.com/ugd/b5aed9_ea6d527748af4735bbaf3d1e04cd789c.pdf?index=true
• https://ffea93e8-1295-496d-b601-fe17127891ad.filesusr.com/ugd/e50c99_d70d100679f6428d87d5068bf81ae837.pdf?index=true
• https://be1440b0-b9a7-47f0-b870-2f4aeefb1505.filesusr.com/ugd/ad2ade_49721523c6d54c6683918db211a8eff8.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• 5e27d4e2-f35c-4a2d-8a48-bccce24b99ec.filesusr.com
• 76d74cd5-fceb-42b2-a8db-b82c6b99e9d4.filesusr.com
• 8f015f00-93c7-4512-8169-39c189266fcf.filesusr.com
• dbef59a2-7900-4c35-8b34-5a0ccb087d77.filesusr.com
• 3679bca5-1a69-44b3-bbf7-b495a757294b.filesusr.com
• 2f62ba1c-d601-4fa8-8555-b6470f7ba64c.filesusr.com
• 819086d6-e7d2-448b-9b89-aebbf5e7eb45.filesusr.com
• 2d914652-ecd0-47fd-9aaa-a7846f837762.filesusr.com
• b13ecb4b-ef23-4bae-87fd-3343e7b4e0d2.filesusr.com
• 9d6dd21d-9b51-49dd-86f1-0c6895ac356a.filesusr.com
• af591e4f-daaf-4685-a131-d67185808cb9.filesusr.com
• 26b34fd8-5e4e-4a3e-bfea-e1d5681bf8f2.filesusr.com
• 7189949c-1110-4485-b771-9388a4fe6c39.filesusr.com
• ffea93e8-1295-496d-b601-fe17127891ad.filesusr.com
• be1440b0-b9a7-47f0-b870-2f4aeefb1505.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report