MALICIOUS — 3c8574_b283a0040a374f0ca4ceb7b8714de016.pdf

MALICIOUS — 3c8574_b283a0040a374f0ca4ceb7b8714de016.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 0c3bf76082a04469d71168bd2ff24df7921d75f7ea119acbbf9da3d40d2e50bd
• SHA-1: cead216874eb24d5a275bcad4ec184b6383041e8
• MD5: a527f357f4711caa961e98deae34fa4d
• ssdeep: 768:xgGzpDFgKcKajwv5w6gZJ1gqayJCh0R1rkHJVc5gU44qtu400tD2iIq3NOXhkEsj:CGFJgx2GZJNnJCa1rkHcgv4qI4kWNOKp
• TLSH: T1F032BEF3106BDD487E825B07AEE615587446D68D3133A3A449D87B7CC4BC6FCAE40A21
• Submitted as: 3c8574_b283a0040a374f0ca4ceb7b8714de016.pdf
• File type: pdf · Size: 47280 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=movie+hd+apk+download+2020, http://files.anamcharaministries.org/uploads/1/3/1/6/131606755/4c2d42874c.pdf, http://files.thecharlottebandb.com/uploads/1/3/1/3/131381363/vifisi.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=movie+hd+apk+download+2020
• http://files.anamcharaministries.org/uploads/1/3/1/6/131606755/4c2d42874c.pdf
• http://files.thecharlottebandb.com/uploads/1/3/1/3/131381363/vifisi.pdf
• http://files.danielmerza.com/uploads/1/3/2/8/132815054/wawopugived.pdf
• https://f56bd7be-2770-411b-8b25-d8e2b78fabe9.filesusr.com/ugd/a2de88_6c6bb696bce841a28afde851b54b5d15.pdf?index=true
• https://cdn.shopify.com/s/files/1/0437/5825/6286/files/tomtom_mydrive_connect_keychain.pdf
• https://cdn.shopify.com/s/files/1/0430/3486/9921/files/83588672067.pdf
• https://343c21e8-fb6a-4ff3-9fed-e3048fd3ee11.filesusr.com/ugd/696117_b56939fb6c88477795c6438c3f60ed49.pdf?index=true
• https://c7649d9d-1095-4d0b-820b-e76d3a02362a.filesusr.com/ugd/a91264_99718c8adc6f4569ac75d32cea69af54.pdf?index=true
• https://11baff4e-9b89-481a-80c3-58fc7d2fab6a.filesusr.com/ugd/65b209_3fdf19f87b164075909c116761add47a.pdf?index=true
• https://03fa8c1c-edd9-4e65-a472-2e9b4e632bb8.filesusr.com/ugd/5bb01c_a97c4ea240344867b53b20342ad334d3.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• files.anamcharaministries.org
• files.thecharlottebandb.com
• files.danielmerza.com
• f56bd7be-2770-411b-8b25-d8e2b78fabe9.filesusr.com
• cdn.shopify.com
• 343c21e8-fb6a-4ff3-9fed-e3048fd3ee11.filesusr.com
• c7649d9d-1095-4d0b-820b-e76d3a02362a.filesusr.com
• 11baff4e-9b89-481a-80c3-58fc7d2fab6a.filesusr.com
• 03fa8c1c-edd9-4e65-a472-2e9b4e632bb8.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report