MALICIOUS — 733c1f_d1acdae6dd5d48559beed3dca9728b0f.pdf

MALICIOUS — 733c1f_d1acdae6dd5d48559beed3dca9728b0f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 143c28d4f08756ce3d1b9c9c488777a3a57d5930a468330dcbc1910078f64138
SHA-1: f8db776c1427423a987c23f9f910d3514ad14916
MD5: 97349335255269c47ab363a1c3f33ff6
ssdeep: 1536:DGF1fXdhdbSg8eK0WX58DmRiR+FBlxk2vbtu7MnYzHfJkBf:SF1fdhpSgulu+flxkKbY75fJq
TLSH: T1B136DFF3456BDE8C799797079DF2105A2085C2891223AB7448CAB7ACC4FC3BEDD11690
Submitted as: 733c1f_d1acdae6dd5d48559beed3dca9728b0f.pdf
File type: pdf · Size: 68192 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.link/wix?keyword=word+whizzle+castles+answers+african+countries, https://cdn.shopify.com/s/files/1/0463/3837/5842/files/pogud.pdf, https://cdn.shopify.com/s/files/1/0440/8334/7606/files/47446273954.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.link/wix?keyword=word+whizzle+castles+answers+african+countries
https://cdn.shopify.com/s/files/1/0463/3837/5842/files/pogud.pdf
https://cdn.shopify.com/s/files/1/0440/8334/7606/files/47446273954.pdf
https://cdn.shopify.com/s/files/1/0434/1104/6558/files/31572555365.pdf
https://cdn.shopify.com/s/files/1/0432/6549/1106/files/84348771712.pdf
http://rukalil.narrins.com/uploads/1/3/1/8/131856408/viruwok.pdf
http://zunaruka.letstrythat.ca/uploads/1/3/1/8/131872144/gosilugove_vixowegodomewis_dumoruzovubonu_gosajaw.pdf
http://files.janeramsey.com/uploads/1/3/0/7/130739883/043c5fe929c.pdf
http://toxipuv.booksbyrhondabrown.com/uploads/1/3/0/9/130969149/7168a541f.pdf
http://files.gohea.org/uploads/1/3/1/4/131438150/902c87ef.pdf
https://78b4f21e-2595-4ffc-9d88-bb3e577f853b.filesusr.com/ugd/8c0e65_77497eb043e946608ce5c8aa6acf8d73.pdf?index=true
https://cd10388b-8a0c-4e7b-8a4d-891d693c0695.filesusr.com/ugd/9bd82e_62ef9964fba14bd580dae011cc978381.pdf?index=true
https://cfbfa34a-c8d7-4e62-badb-fb3e46ec4a3c.filesusr.com/ugd/b5472a_40d185cb774a467c96d288d04a781bfc.pdf?index=true
https://7b197c15-2750-4408-bac7-15f72965fd8d.filesusr.com/ugd/bca722_0b14dccbe3f0406587d6ade60e4e417c.pdf?index=true
https://cdn.shopify.com/s/files/1/0430/4227/5479/files/julopikulepadesenufexe.pdf
https://cdn.shopify.com/s/files/1/0431/8127/7352/files/43913415458.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.link
cdn.shopify.com
rukalil.narrins.com
zunaruka.letstrythat.ca
files.janeramsey.com
toxipuv.booksbyrhondabrown.com
files.gohea.org
78b4f21e-2595-4ffc-9d88-bb3e577f853b.filesusr.com
cd10388b-8a0c-4e7b-8a4d-891d693c0695.filesusr.com
cfbfa34a-c8d7-4e62-badb-fb3e46ec4a3c.filesusr.com
7b197c15-2750-4408-bac7-15f72965fd8d.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report