MALICIOUS — 3f8d85_5620bc44fe9d48529f8610cbac1ad0f3.pdf

MALICIOUS — 3f8d85_5620bc44fe9d48529f8610cbac1ad0f3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 0ca2f9d3e55599bd2756b7daf9b39363bf695c8a0c2374d7baeb129328bddf0c
SHA-1: 95fda1c1316466f9133cfb39729026038bb3e6d1
MD5: 7e158c28eb6214bd03c2277b6cb23fb5
ssdeep: 1536:uGF7v/zQn9xb+5x/wUH2OeYuH1JSvPQKMxGKc+XPRlWM4ZzZ:XF7XMex/wUWOQH7SvP+GKcaOM4b
TLSH: T16336D0F30097ED8C6ED3A7836DEA1048E545CB8532329AA014DCBA6C94785BCAF55C61
Submitted as: 3f8d85_5620bc44fe9d48529f8610cbac1ad0f3.pdf
File type: pdf · Size: 64590 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.me/wix?keyword=special+concrete+shear+wall+design+example, https://cdn.shopify.com/s/files/1/0429/7578/9215/files/parvatichya_bala_video_song_free.pdf, https://cdn.shopify.com/s/files/1/0431/7492/0347/files/pokorud.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.me/wix?keyword=special+concrete+shear+wall+design+example
https://cdn.shopify.com/s/files/1/0429/7578/9215/files/parvatichya_bala_video_song_free.pdf
https://cdn.shopify.com/s/files/1/0431/7492/0347/files/pokorud.pdf
https://cdn.shopify.com/s/files/1/0454/8358/9782/files/caligula_s_horse_discography.pdf
https://cdn.shopify.com/s/files/1/0438/6412/9696/files/dosomobodadiridagerogudit.pdf
https://cdn.shopify.com/s/files/1/0432/9861/9557/files/46821524498.pdf
http://files.fourthuu.org/uploads/1/3/0/8/130813866/befugafijodegal.pdf
http://wifox.megatronevents.com/uploads/1/3/1/3/131382078/1567157.pdf
http://files.solalpine.com/uploads/1/3/1/4/131438348/kotises-mabakusokidej.pdf
http://files.virtualsaguaro.com/uploads/1/3/1/8/131856039/8e0cd23.pdf
http://files.heartoftexasarmory.com/uploads/1/3/0/8/130874284/4195896.pdf
https://d7222124-0e67-449d-b3c3-c41fbef87edf.filesusr.com/ugd/23b571_dcc1fb5db0054e65a0f9418ec4778a36.pdf?index=true
https://86f7088c-3566-45ee-8a36-5985f351a18a.filesusr.com/ugd/c88839_5476f3add8cd49e69c68e9d35a700ce3.pdf?index=true
https://b0b4b7d9-588c-43a3-92f1-fe65f1d7c38d.filesusr.com/ugd/9f2514_1359b9ff8a0a40c3be9e334b86bbfdcf.pdf?index=true
https://dbfc28a8-4369-4d3e-b998-df297565a0a9.filesusr.com/ugd/eda9ba_1f1bce5e15354d668d80005650e12ac9.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.me
cdn.shopify.com
files.fourthuu.org
wifox.megatronevents.com
files.solalpine.com
files.virtualsaguaro.com
files.heartoftexasarmory.com
d7222124-0e67-449d-b3c3-c41fbef87edf.filesusr.com
86f7088c-3566-45ee-8a36-5985f351a18a.filesusr.com
b0b4b7d9-588c-43a3-92f1-fe65f1d7c38d.filesusr.com
dbfc28a8-4369-4d3e-b998-df297565a0a9.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report