MALICIOUS — 451a43_b8d490e4563e4dbab28ab3eaa75c43dc.pdf

MALICIOUS — 451a43_b8d490e4563e4dbab28ab3eaa75c43dc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 10d5149dcea61000cb1800fd29b913eb2ef92da6040161eb7470ccbf513f87e7
• SHA-1: 6606621f669d5b5d6c7470e8334f6cef9752f06d
• MD5: a79846fc802d16c90ffd8805462efdc2
• ssdeep: 768:zgGzpDmRt2QDfADEngQ4Gtj/VQNcCw+Sdvb7rXjzsPYppkbtz:MGFy5gHGpocNdjfzzsPVbtz
• TLSH: T10F31AEF3149BED8C7A876F17ADAB11996046C28D5132E77045887B7CCD7C2ADAF01920
• Submitted as: 451a43_b8d490e4563e4dbab28ab3eaa75c43dc.pdf
• File type: pdf · Size: 41124 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=m-audio+fast+track+drivers+windows, http://rewilul.wstcharity.com/uploads/1/3/1/6/131606295/sureme_xekoz_tufigunonoz.pdf, http://files.2ndchanceapartment.com/uploads/1/3/0/7/130775396/gonimirefi_monapo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=m-audio+fast+track+drivers+windows
• http://rewilul.wstcharity.com/uploads/1/3/1/6/131606295/sureme_xekoz_tufigunonoz.pdf
• http://files.2ndchanceapartment.com/uploads/1/3/0/7/130775396/gonimirefi_monapo.pdf
• http://files.businesslawtemecula.com/uploads/1/3/1/1/131164452/roxozixu-bijizuzi.pdf
• http://files.creative-twinkles.com/uploads/1/3/0/9/130970022/9646657.pdf
• http://files.aldenmovesbk.com/uploads/1/3/2/3/132303406/tubofiwukoj-bazira-bowas.pdf
• http://files.jasminkwan.com/uploads/1/3/1/0/131071166/a9d5c.pdf
• http://gezepuro.dominiqueluster.com/uploads/1/3/1/4/131406925/ritesepape.pdf
• http://nogusug.astoria2000.net/uploads/1/3/1/1/131164250/2877587.pdf
• https://ff97e056-a4d3-480e-882e-ca5d7d60c3dd.filesusr.com/ugd/78daac_ba28091448974a9194e67d17a83018a1.pdf?index=true
• https://0752870a-291c-4ea5-944a-5fbfa2128e2f.filesusr.com/ugd/ceb2e8_4d7cd2d7a7484ae2a1e18bbddd034348.pdf?index=true
• https://d661aab1-88f2-402c-a6a5-4295e19fc2a9.filesusr.com/ugd/48bf55_fb96224d17e84ff1a84afb3c7a4e0b55.pdf?index=true
• https://7d9f1a32-e83b-47a7-a2f7-aac3bc89a056.filesusr.com/ugd/dcc11b_848f46d7ef9e4090993e02602683ce21.pdf?index=true
• https://7ef6ea99-c2a0-4ae2-9f9b-57cbcaea7b7b.filesusr.com/ugd/e2b09b_70d7027fd23b447589f4720eb79b1ea5.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• rewilul.wstcharity.com
• files.2ndchanceapartment.com
• files.businesslawtemecula.com
• files.creative-twinkles.com
• files.aldenmovesbk.com
• files.jasminkwan.com
• gezepuro.dominiqueluster.com
• nogusug.astoria2000.net
• ff97e056-a4d3-480e-882e-ca5d7d60c3dd.filesusr.com
• 0752870a-291c-4ea5-944a-5fbfa2128e2f.filesusr.com
• d661aab1-88f2-402c-a6a5-4295e19fc2a9.filesusr.com
• 7d9f1a32-e83b-47a7-a2f7-aac3bc89a056.filesusr.com
• 7ef6ea99-c2a0-4ae2-9f9b-57cbcaea7b7b.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report