MALICIOUS — 9734e7_40e9c61e13ed42e0a37466c5972ff0bb.pdf

MALICIOUS — 9734e7_40e9c61e13ed42e0a37466c5972ff0bb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 186e0dc3f13be6e424220ea7e1db786d7d11127926377e7c79c8099c0442b06c
• SHA-1: 72402f7ef3e60ffc6fcb91ddef55780475782e65
• MD5: 0b39b0c11117d90c45ca1339165d24a1
• ssdeep: 768:XNgGzpDTQiU4a3W2rCMnrUYJLty0zX3UHoDfOMaT/hG5qst:+GF/kCMLy0TVDfH8o5qst
• TLSH: T1A7317DF32097ED8C7AC79F036EEA24196045E7482132A674849D7B6CC8BC6BD6E50970
• Submitted as: 9734e7_40e9c61e13ed42e0a37466c5972ff0bb.pdf
• File type: pdf · Size: 42390 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=lehninger+biochemistry+7th+edition+pdf+download, https://cdn.shopify.com/s/files/1/0430/1216/1685/files/free_gantt_chart_template_microsoft_excel.pdf, https://cdn.shopify.com/s/files/1/0429/3387/8940/files/36048360704.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=lehninger+biochemistry+7th+edition+pdf+download
• https://cdn.shopify.com/s/files/1/0430/1216/1685/files/free_gantt_chart_template_microsoft_excel.pdf
• https://cdn.shopify.com/s/files/1/0429/3387/8940/files/36048360704.pdf
• https://cdn.shopify.com/s/files/1/0481/3393/1175/files/jijazopuzagas.pdf
• https://cdn.shopify.com/s/files/1/0440/5297/1685/files/81741914939.pdf
• https://cdn.shopify.com/s/files/1/0480/8405/8266/files/flatten_binary_tree_to_linked_list_youtube.pdf
• https://06958dbc-9544-4fdb-b1f3-4130c747a00b.filesusr.com/ugd/9bd82e_1bda630a9ad9486991f47fe3b65995ac.pdf?index=true
• https://193be36c-276d-4462-9a3c-2951978203a5.filesusr.com/ugd/9ea91e_66be1cb0efef46599b475fd6847af688.pdf?index=true
• https://f328dcf4-562d-4648-8e16-1dfd52a83eec.filesusr.com/ugd/69695d_f979307bba35439885ce36b09a569c25.pdf?index=true
• https://f11923d2-8d12-4a17-8c9b-860daa08e33c.filesusr.com/ugd/5f226b_76f7657d87874037a4060fba617bf060.pdf?index=true
• https://a9179f4f-554c-4ff9-9444-e7f426647c84.filesusr.com/ugd/2d797c_0dfc9f26ddc3432aa5124171789616dd.pdf?index=true
• http://files.asianyoungmusiciansconnection.com/uploads/1/3/1/3/131381480/5671129.pdf
• http://files.theleonamiller14daychallenge.com/uploads/1/3/1/0/131069887/09e93506b1d2.pdf
• http://files.seer-gallery.com/uploads/1/3/1/1/131163540/wuxuzonixapoju.pdf
• http://wagete.gonfp.com/uploads/1/3/2/6/132682235/6367766.pdf
• http://files.ro2art.com/uploads/1/3/0/7/130776166/3860065.pdf
• https://f95b338f-55ce-4522-91f5-ce8b02dba5fe.filesusr.com/ugd/91e123_bb3639cf5b96421a945781d6de0a67c9.pdf?index=true
• https://cfd57a6b-ac1f-4179-b5b1-fb298ef31b84.filesusr.com/ugd/3bcfef_6a65e7386ca54496815db0e06993dc05.pdf?index=true
• https://933105c2-8628-41df-b9f5-cf8633f6db37.filesusr.com/ugd/f3cb45_12a5c58110bb4282a8f6c29781cf299c.pdf?index=true
• https://1a41195d-2810-42bf-b6d1-e3fd2ae345f9.filesusr.com/ugd/ed2d23_28d52755c2584810b1f7c8352326a386.pdf?index=true
• https://4e67f78b-c139-4cfe-951c-7a9d5b2989cd.filesusr.com/ugd/0789d5_361af1be941d47818047519d2b87f8b3.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• ttraff.club
• cdn.shopify.com
• 06958dbc-9544-4fdb-b1f3-4130c747a00b.filesusr.com
• 193be36c-276d-4462-9a3c-2951978203a5.filesusr.com
• f328dcf4-562d-4648-8e16-1dfd52a83eec.filesusr.com
• f11923d2-8d12-4a17-8c9b-860daa08e33c.filesusr.com
• a9179f4f-554c-4ff9-9444-e7f426647c84.filesusr.com
• files.asianyoungmusiciansconnection.com
• files.theleonamiller14daychallenge.com
• files.seer-gallery.com
• wagete.gonfp.com
• files.ro2art.com
• f95b338f-55ce-4522-91f5-ce8b02dba5fe.filesusr.com
• cfd57a6b-ac1f-4179-b5b1-fb298ef31b84.filesusr.com
• 933105c2-8628-41df-b9f5-cf8633f6db37.filesusr.com
• 1a41195d-2810-42bf-b6d1-e3fd2ae345f9.filesusr.com
• 4e67f78b-c139-4cfe-951c-7a9d5b2989cd.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report