MALICIOUS — d1fcfc_c74c9b6816214c4088904346279348ae.pdf

MALICIOUS — d1fcfc_c74c9b6816214c4088904346279348ae.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 113746c8bdb1867eeb0973d174d6347a55e584c831c7958c6e7d3ee70f3ddc01
• SHA-1: 0916b4b2cbde282e6e1420e8be76a87ef0865606
• MD5: d0fa6f48d8524df69b369e6c7b6e34ca
• ssdeep: 768:S7gGzpDblDkv9vWYraQay98FYhwhbs0k5vVvl79MeC8U99TjqIQM:SEGF/twPSjRPcvlEjqIQM
• TLSH: T13933B0F3909BDC8C7E99AB037DD710A76156C3896123932018E83A6CC57C6FDAE10D61
• Submitted as: d1fcfc_c74c9b6816214c4088904346279348ae.pdf
• File type: pdf · Size: 51060 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=tecumseh-service-manual-4-cycles-3-+11+hp, https://820a9583-fc53-45fc-8e64-11d4b3261770.filesusr.com/ugd/48bf55_93370d1c997e44c8a082e456eac2f65e.pdf?index=true, https://b50412b5-6c33-48c8-b49b-6084235b930d.filesusr.com/ugd/18122d_187c2407597748999946d63e5eac4efe.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=tecumseh-service-manual-4-cycles-3-+11+hp
• https://820a9583-fc53-45fc-8e64-11d4b3261770.filesusr.com/ugd/48bf55_93370d1c997e44c8a082e456eac2f65e.pdf?index=true
• https://b50412b5-6c33-48c8-b49b-6084235b930d.filesusr.com/ugd/18122d_187c2407597748999946d63e5eac4efe.pdf?index=true
• https://2ccb366b-a18c-4128-bcdb-21d032919c5a.filesusr.com/ugd/5ea691_cdea084996f54ce8a5ae3970b591c39a.pdf?index=true
• http://files.countrysquirewinery.com/uploads/1/3/1/8/131856627/b09c9.pdf
• http://files.ipdga.com/uploads/1/3/0/9/130969982/serujukisozit.pdf
• http://rurudone.hbluxury.co/uploads/1/3/1/3/131381658/luvixij_zexepejowat_rebedizorenu_bofoxivexagu.pdf
• http://bijas.w-shi.net/uploads/1/3/0/7/130738836/c1879ebf219a28.pdf
• https://cdn.shopify.com/s/files/1/0432/0693/4688/files/genituje.pdf
• https://cdn.shopify.com/s/files/1/0432/2374/4674/files/majurifowevukelipe.pdf
• https://cdn.shopify.com/s/files/1/0428/7964/7903/files/faludagajuvugakopusotazo.pdf
• https://ed991b22-1601-4314-a125-f18ff9160019.filesusr.com/ugd/d7d6cd_b1e54e99e3e74ea8813bf1573894eadc.pdf?index=true
• https://b9f9532a-abd6-41d8-80e2-956eead7e37b.filesusr.com/ugd/974a4e_8ce106d47a5f472b83fb2ea27183dd76.pdf?index=true
• https://fe4c9c8d-c2f2-4ae8-9e53-7eec50c502f4.filesusr.com/ugd/277b62_c70ec0c622f6463daeeacb160a2a7fc0.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• 820a9583-fc53-45fc-8e64-11d4b3261770.filesusr.com
• b50412b5-6c33-48c8-b49b-6084235b930d.filesusr.com
• 2ccb366b-a18c-4128-bcdb-21d032919c5a.filesusr.com
• files.countrysquirewinery.com
• files.ipdga.com
• rurudone.hbluxury.co
• bijas.w-shi.net
• cdn.shopify.com
• ed991b22-1601-4314-a125-f18ff9160019.filesusr.com
• b9f9532a-abd6-41d8-80e2-956eead7e37b.filesusr.com
• fe4c9c8d-c2f2-4ae8-9e53-7eec50c502f4.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report