MALICIOUS — 7be1cd_e715ddac80c94cefa4947a8ce1cb943d.pdf

MALICIOUS — 7be1cd_e715ddac80c94cefa4947a8ce1cb943d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 0dc4e43701e3bbcc928391d57209c6ffd447e2e0211fcb18efacfde69d3f14d9
• SHA-1: 17417b41a761218daa5f11647d172ceefcb47b95
• MD5: 3807aa88b197d1ec6a9c130613e6d55b
• ssdeep: 768:qgGzpDL0kqziHZljjWTisem2p7ZYjIaAlcvKeSI8h5iC:3GFnXZlPWTiFVVcvKeSI8hMC
• TLSH: T145328DF760A7ED8C7E8BDF077EDA22199045E68C51329764099C6B2CC4BC3BD6E04921
• Submitted as: 7be1cd_e715ddac80c94cefa4947a8ce1cb943d.pdf
• File type: pdf · Size: 44013 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=moonbase+alpha+command+center, http://files.myguillermofloresuagro.net/uploads/1/3/1/4/131407067/duzuzanuxawomoz.pdf, http://zepubo.gaelicfootballsa.com/uploads/1/3/1/4/131438641/07f98a.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=moonbase+alpha+command+center
• http://files.myguillermofloresuagro.net/uploads/1/3/1/4/131407067/duzuzanuxawomoz.pdf
• http://zepubo.gaelicfootballsa.com/uploads/1/3/1/4/131438641/07f98a.pdf
• http://files.chsboosters.net/uploads/1/3/1/3/131398533/juvaxolusigovigipeje.pdf
• https://9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com/ugd/dcf311_bfbd33e20a804fa09b269749c2a18b2e.pdf?index=true
• https://42c96d3b-411e-4100-a0cc-3e42c25e3a09.filesusr.com/ugd/154db6_20c8913494244b0d9413fc98e1a82726.pdf?index=true
• https://c55a8e8e-f659-4972-acee-02f43e91aa68.filesusr.com/ugd/0b46e6_31a11b04b5b647299fc54ae7bb2987a3.pdf?index=true
• https://c837c6ca-8240-4036-9a46-2a671d99eeac.filesusr.com/ugd/d6af85_2f58677fe14f4d74a7bc66aec2d9058c.pdf?index=true
• https://560b0f8b-4a6e-40ea-89c3-9de942e3d5cb.filesusr.com/ugd/3ed902_7c06b90dcadc4259b2db58b878bbdc1b.pdf?index=true
• https://2d6ef120-928d-4c9e-b275-fc77c243a74a.filesusr.com/ugd/227d0f_d9281a9a6fdf4e689d2d910548a96acf.pdf?index=true
• https://40429b4b-d855-4b32-aa6b-cea0adbafd6d.filesusr.com/ugd/5bb01c_536037b408f84525b7b23cb12ad997e0.pdf?index=true
• https://01dbf5a0-6041-49b2-b7b1-6dc0f12b3335.filesusr.com/ugd/dcf9ad_5bb9d7224d174eca9e7b7c3aa65d0898.pdf?index=true
• https://7ccf4aa6-626f-414f-b866-4df257487e46.filesusr.com/ugd/eb6612_6fea4f336c444179bf97dd8ad3c7ea3b.pdf?index=true
• https://046271e0-5544-4b74-9052-808681b28479.filesusr.com/ugd/2994dd_d82977ef085c4c598a4996df0858ba6f.pdf?index=true
• https://cdn.shopify.com/s/files/1/0440/6195/0117/files/apache_tomcat_8._5._37.pdf
• https://cdn.shopify.com/s/files/1/0459/7042/3968/files/perichondritis_antibiotics_guidelines.pdf
• https://cdn.shopify.com/s/files/1/0462/5019/7146/files/87641796594.pdf
• https://cdn.shopify.com/s/files/1/0430/6875/2023/files/printable_medical_terminology_quiz_with_answers.pdf
• https://cdn.shopify.com/s/files/1/0428/9105/1161/files/vewaboniginon.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• files.myguillermofloresuagro.net
• zepubo.gaelicfootballsa.com
• files.chsboosters.net
• 9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com
• 42c96d3b-411e-4100-a0cc-3e42c25e3a09.filesusr.com
• c55a8e8e-f659-4972-acee-02f43e91aa68.filesusr.com
• c837c6ca-8240-4036-9a46-2a671d99eeac.filesusr.com
• 560b0f8b-4a6e-40ea-89c3-9de942e3d5cb.filesusr.com
• 2d6ef120-928d-4c9e-b275-fc77c243a74a.filesusr.com
• 40429b4b-d855-4b32-aa6b-cea0adbafd6d.filesusr.com
• 01dbf5a0-6041-49b2-b7b1-6dc0f12b3335.filesusr.com
• 7ccf4aa6-626f-414f-b866-4df257487e46.filesusr.com
• 046271e0-5544-4b74-9052-808681b28479.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report