MALICIOUS — a4c1fa_0111e1f6fc5b4cc48076c18974d2810a.pdf

MALICIOUS — a4c1fa_0111e1f6fc5b4cc48076c18974d2810a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 115744827e4172f1bf11f7a815b609001e19c925d2fae808ad94e12f2612000d
• SHA-1: 3d72132e1cbe388e6bd7e85617e1d8fcae19db0b
• MD5: 957bec1b60e5dad5a27c812922b91409
• ssdeep: 768:VgGzpDP5ykDVJr/uKOgtqFr6pHTXdJyraQ8W3s+Yfy6:GGFzFufgc4pHjdJkaQ8bvfy6
• TLSH: T1E4309EF3109FED8C3A8A97432DF70165628ACB496122D760189D772CC4BC6BDAE51461
• Submitted as: a4c1fa_0111e1f6fc5b4cc48076c18974d2810a.pdf
• File type: pdf · Size: 38171 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=iambic+pentameter+worksheet+answer+key, http://files.trudygovier.com/uploads/1/3/1/4/131482988/60b40610d.pdf, http://legepu.localgreenssb.com/uploads/1/3/0/7/130738524/9e3f7c6.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=iambic+pentameter+worksheet+answer+key
• http://files.trudygovier.com/uploads/1/3/1/4/131482988/60b40610d.pdf
• http://legepu.localgreenssb.com/uploads/1/3/0/7/130738524/9e3f7c6.pdf
• http://files.christschampionsministries.org/uploads/1/3/2/6/132681672/9671238.pdf
• http://jusaro.royaltyprint.net/uploads/1/3/0/7/130776533/4650a.pdf
• http://files.irishwindenglishshepherds.com/uploads/1/3/1/4/131438188/bijigexefilenupega.pdf
• https://cdn.shopify.com/s/files/1/0438/8470/7992/files/civic_eg_k_swap_guide.pdf
• https://cdn.shopify.com/s/files/1/0430/9906/2421/files/chasing_ball_chinese_drama_eng_sub.pdf
• https://cdn.shopify.com/s/files/1/0431/0673/0144/files/69628285394.pdf
• https://cdn.shopify.com/s/files/1/0437/9561/1810/files/adobe_printer_error.pdf
• https://cdn.shopify.com/s/files/1/0428/1666/7815/files/business_intelligence_strategy.pdf
• http://jamebuw.clairecoulter.com/uploads/1/3/0/7/130740434/7701ed47ec03de6.pdf
• http://posimulen.wheektown.com/uploads/1/3/0/7/130775897/298188.pdf
• http://files.exitstrategyband.com/uploads/1/3/1/3/131379183/denapawif.pdf
• http://vijonexe.klinepoodles.com/uploads/1/3/0/8/130874330/c62427.pdf
• http://sexisuk.dorothyabram.com/uploads/1/3/0/9/130969904/zojemimijena.pdf
• https://17752df4-9fbe-48e9-b576-ba417c3edf49.filesusr.com/ugd/70e5f7_d13fdd3588d44669bfd4d68c962f62b8.pdf?index=true
• https://73eaea15-0dd3-44aa-aa24-e767e76ca624.filesusr.com/ugd/9e41f0_bdc9eaf16fd641618509325da7baf338.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• files.trudygovier.com
• legepu.localgreenssb.com
• files.christschampionsministries.org
• jusaro.royaltyprint.net
• files.irishwindenglishshepherds.com
• cdn.shopify.com
• jamebuw.clairecoulter.com
• posimulen.wheektown.com
• files.exitstrategyband.com
• vijonexe.klinepoodles.com
• sexisuk.dorothyabram.com
• 17752df4-9fbe-48e9-b576-ba417c3edf49.filesusr.com
• 73eaea15-0dd3-44aa-aa24-e767e76ca624.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report