MALICIOUS — dc8a8e_ff679102bc7046daa318286696a95318.pdf

MALICIOUS — dc8a8e_ff679102bc7046daa318286696a95318.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 13f64a23665b4ac2d364daa9fdb29602bf925418a9b530972703f8eecd38198b
• SHA-1: 28b5e3af7f83bc551339e700726deb179b847d64
• MD5: 7f334f958f6a936a8b36ec1c137ed22f
• ssdeep: 768:ggGzpDgiCVP1C0//HGJllQejdVD9zWRQAV9fjzzzofv:tGFsiq/fuJpV96RQAV9f/ofv
• TLSH: T169319EF75187EC8C778B9B07AADB11596585E68D6273D66009CD3B3CC47C2ECAE00A24
• Submitted as: dc8a8e_ff679102bc7046daa318286696a95318.pdf
• File type: pdf · Size: 42361 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=genetic+disorders+worksheet+answer+key, http://begupu.newwoodturners.org/uploads/1/3/2/7/132740267/zoboregekalamojaba.pdf, http://vofanexuf.sanclementecarpetclean.com/uploads/1/3/1/4/131408172/2695190.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=genetic+disorders+worksheet+answer+key
• http://begupu.newwoodturners.org/uploads/1/3/2/7/132740267/zoboregekalamojaba.pdf
• http://vofanexuf.sanclementecarpetclean.com/uploads/1/3/1/4/131408172/2695190.pdf
• http://files.glenechopottery.com/uploads/1/3/0/7/130776769/dc5afd5b111.pdf
• http://files.madisonswcd.org/uploads/1/3/1/0/131069890/fc9d6805.pdf
• http://files.whatson-mg.co.uk/uploads/1/3/1/4/131409309/1117634.pdf
• https://cdn.shopify.com/s/files/1/0434/5466/0758/files/81025882864.pdf
• https://65a676bc-0694-4ff5-87b2-4507a04416b4.filesusr.com/ugd/89064d_5aba75ee95bf4fc7aaa6781438956d71.pdf?index=true
• https://58dbe4a7-685c-4e19-acd2-f8ad1f10f6e9.filesusr.com/ugd/6f9b04_90c2139f2dbb49a3b2256f5a28ee0f45.pdf?index=true
• https://445d226a-dde1-41b3-9045-302692bb9bf6.filesusr.com/ugd/baef12_eb2f3792c56443ea81997c9a35fd6445.pdf?index=true
• https://410fdd8e-75a6-42ac-ac10-320e8f664462.filesusr.com/ugd/a2de88_2f9f05a8550e475ab2f3d4230e0f1961.pdf?index=true
• https://c9abc0cd-d179-4c2b-9bb5-4bdc16e9dcdc.filesusr.com/ugd/8bf3fc_e1fd56a2d43e4c49acc8c4942b995184.pdf?index=true
• https://7bc8c8c7-fc6d-4a78-93a8-db1ce07a8f4f.filesusr.com/ugd/296484_16a1842be7164f55a50a18c6c3528d08.pdf?index=true
• https://9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com/ugd/dcf311_bfbd33e20a804fa09b269749c2a18b2e.pdf?index=true
• https://ea251745-e9fc-4daf-8838-3fbc7e94d97e.filesusr.com/ugd/384ea4_0985c6ece0824e0189ac8a8578d409c8.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• begupu.newwoodturners.org
• vofanexuf.sanclementecarpetclean.com
• files.glenechopottery.com
• files.madisonswcd.org
• files.whatson-mg.co.uk
• cdn.shopify.com
• 65a676bc-0694-4ff5-87b2-4507a04416b4.filesusr.com
• 58dbe4a7-685c-4e19-acd2-f8ad1f10f6e9.filesusr.com
• 445d226a-dde1-41b3-9045-302692bb9bf6.filesusr.com
• 410fdd8e-75a6-42ac-ac10-320e8f664462.filesusr.com
• c9abc0cd-d179-4c2b-9bb5-4bdc16e9dcdc.filesusr.com
• 7bc8c8c7-fc6d-4a78-93a8-db1ce07a8f4f.filesusr.com
• 9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com
• ea251745-e9fc-4daf-8838-3fbc7e94d97e.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report