MALICIOUS — 952c2e_6037984de91f49af9f5dc3fc2e69ceb8.pdf

MALICIOUS — 952c2e_6037984de91f49af9f5dc3fc2e69ceb8.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 1a9d812679ad303aaa6ff16bde9a27915f97dc567cd0e85ca142df05a93c6815
• SHA-1: d40f383de24cb6b82b25156f3de9923f330de546
• MD5: 61cd880f695fb90c0c4082ce7ff74b88
• ssdeep: 768:9gGzpDjnCHC8j4wz3uisGgbdj52VpTnIFgbIpJqfgnthH0h9nsMxZemAbnLJ:+GFPOb8kuisGgbdj5WTUgE6gn70fssAB
• TLSH: T191339DF3109BFC8C694B9B075E6A2499708AC3CD613796A448D8B63CC4BC7ED6F11921
• Submitted as: 952c2e_6037984de91f49af9f5dc3fc2e69ceb8.pdf
• File type: pdf · Size: 48558 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=fingersmith+pdf+free, http://voginupib.fundamentallysoundbasketball.net/uploads/1/3/1/6/131606228/235189.pdf, http://files.pastorvaleriepope.com/uploads/1/3/0/7/130740547/mawakezozot-mibirok-sisovolazu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=fingersmith+pdf+free
• http://voginupib.fundamentallysoundbasketball.net/uploads/1/3/1/6/131606228/235189.pdf
• http://files.pastorvaleriepope.com/uploads/1/3/0/7/130740547/mawakezozot-mibirok-sisovolazu.pdf
• http://files.joinzombieclub.com/uploads/1/3/1/3/131384468/ponikutigokeza.pdf
• http://xazevok.theekklesiacenter.org/uploads/1/3/0/7/130776407/4030063.pdf
• http://xubodosi.milagrodesignsantafe.com/uploads/1/3/1/3/131380005/gaxuk.pdf
• http://files.lawyerchicago.com/uploads/1/3/0/8/130874554/1738777.pdf
• http://mubom.threesisterstudio.com/uploads/1/3/1/0/131070374/piwax.pdf
• http://files.carchethealing.com/uploads/1/3/1/0/131070192/4819613.pdf
• http://files.ravenartcenter.com/uploads/1/3/0/9/130970016/fifefez.pdf
• http://files.greenlightinspection.com/uploads/1/3/1/4/131437873/6320ca56ab0.pdf
• http://files.meltingtundra.com/uploads/1/3/2/6/132681771/libugabagigad.pdf
• http://koromusud.hipsterleaks.com/uploads/1/3/0/9/130969627/nubadozogawifidenig.pdf
• http://files.getyouthmoving.net/uploads/1/3/1/8/131856188/marerabukutakegov.pdf
• https://75b35160-dea0-464e-8dd0-b1e95085fadc.filesusr.com/ugd/54bec1_3b21d1d17378497c947fdb89c7be3ebd.pdf?index=true
• https://dc75c3fb-3ab7-45db-a227-3b776bce19c5.filesusr.com/ugd/3e87bf_869830ceda6840378d087635ce7fd21e.pdf?index=true
• https://75c30be6-ec5f-4d74-8895-7e11a7054ade.filesusr.com/ugd/162fe6_0cb45a8990d444ea98e7b969e741253a.pdf?index=true
• https://ee850b6c-8737-4163-b4c5-24929de39e0b.filesusr.com/ugd/162fe6_0290de4c942e4fb4b4da67d6d79f0155.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• voginupib.fundamentallysoundbasketball.net
• files.pastorvaleriepope.com
• files.joinzombieclub.com
• xazevok.theekklesiacenter.org
• xubodosi.milagrodesignsantafe.com
• files.lawyerchicago.com
• mubom.threesisterstudio.com
• files.carchethealing.com
• files.ravenartcenter.com
• files.greenlightinspection.com
• files.meltingtundra.com
• koromusud.hipsterleaks.com
• files.getyouthmoving.net
• 75b35160-dea0-464e-8dd0-b1e95085fadc.filesusr.com
• dc75c3fb-3ab7-45db-a227-3b776bce19c5.filesusr.com
• 75c30be6-ec5f-4d74-8895-7e11a7054ade.filesusr.com
• ee850b6c-8737-4163-b4c5-24929de39e0b.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report