MALICIOUS — ab63e3_f42180e61b3c42b7bd15990756731322.pdf

MALICIOUS — ab63e3_f42180e61b3c42b7bd15990756731322.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 1cf47e83d8859a661ef3ffb59ac38507b3b8a0687d7eecacaa98f5b5af8f29e7
• SHA-1: cbd4a9139482e6d418ebf0125b0eede370fa8795
• MD5: 07ed246c880f2412f52f6236a86bff3e
• ssdeep: 768:hgGzpDJxGgRuEGicJkcjOfY28gCQYd42TKr6m9AJZhZz2Nv1t95:SGFNfAPdQx2TKr6m9AJPs5p5
• TLSH: T150329DF32867EC4D3A878F436EAB14194189D24CB132A760099D372CD0BC2BDBF50961
• Submitted as: ab63e3_f42180e61b3c42b7bd15990756731322.pdf
• File type: pdf · Size: 46266 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=fame+101+pdf, https://cdn.shopify.com/s/files/1/0448/3599/5808/files/ios_simulator_in_xcode_download.pdf, https://cdn.shopify.com/s/files/1/0432/5769/2320/files/muxojijozebisafix.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=fame+101+pdf
• https://cdn.shopify.com/s/files/1/0448/3599/5808/files/ios_simulator_in_xcode_download.pdf
• https://cdn.shopify.com/s/files/1/0432/5769/2320/files/muxojijozebisafix.pdf
• https://cdn.shopify.com/s/files/1/0437/6120/5399/files/79202590310.pdf
• https://cdn.shopify.com/s/files/1/0429/9443/4202/files/vokakususabiva.pdf
• https://cdn.shopify.com/s/files/1/0438/5597/0454/files/xowesilibulusomugigebemum.pdf
• https://9ee4e566-4fd6-4cad-9726-6ad1f5769181.filesusr.com/ugd/b444d4_ec1f18ebbaf54de59e211e1a2ca43339.pdf?index=true
• https://3bb8e9a3-afdc-4bc6-98da-bbe232d3a13f.filesusr.com/ugd/8bf3fc_a0256fc49d1243d0abc0052fe03cd454.pdf?index=true
• https://01c4aa1e-9836-42c7-a2e2-daa5efe8e1c8.filesusr.com/ugd/cb4a18_a09a2f9527664548bd005c95e43d28aa.pdf?index=true
• https://c09093f1-e45e-421e-8050-3b567b3ce7af.filesusr.com/ugd/b926a8_a11331bbfd844102af578127b83aed05.pdf?index=true
• http://tasozo.flowersindublin.com/uploads/1/3/1/4/131454215/xidujasawovab.pdf
• http://jugujibi.michelle4edu.com/uploads/1/3/2/6/132683286/vuxawekuxo.pdf
• http://files.specblend.com/uploads/1/3/2/7/132712558/sagexa.pdf
• http://files.greeksns1.com/uploads/1/3/1/3/131379503/3338514.pdf
• http://files.irrigardens.com/uploads/1/3/0/8/130874526/1302231.pdf
• https://cdn.shopify.com/s/files/1/0431/4470/8245/files/camas_antigas_de_madeira_reformadas.pdf
• https://cdn.shopify.com/s/files/1/0427/9340/2534/files/av_8b_harrier_assault_manual.pdf
• https://cdn.shopify.com/s/files/1/0434/1828/8277/files/mozolerukedun.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• cdn.shopify.com
• 9ee4e566-4fd6-4cad-9726-6ad1f5769181.filesusr.com
• 3bb8e9a3-afdc-4bc6-98da-bbe232d3a13f.filesusr.com
• 01c4aa1e-9836-42c7-a2e2-daa5efe8e1c8.filesusr.com
• c09093f1-e45e-421e-8050-3b567b3ce7af.filesusr.com
• tasozo.flowersindublin.com
• jugujibi.michelle4edu.com
• files.specblend.com
• files.greeksns1.com
• files.irrigardens.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report