MALICIOUS — 62172458968.pdf

MALICIOUS — 62172458968.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 1e347ba81d23b328e1335e92a6b6d25a475353dee25574f94abf07e179707b4a
• SHA-1: 5291727d4a7f696daba0c550cceb7c5511f7be2e
• MD5: a90e3fd0920394ec80d444c89800f0ad
• ssdeep: 768:ugGzpDlwpOrDWmJLkVAkAjep0lXH/MXiZqq6vhxZEYdk781Hg3HWojfYVIK4:LGFRTLk3QepUfMXaqFvxG77DLqIK4
• TLSH: T15C339EF310D3ED8C7A8AAF07AABB15BD504AD78C613757A0454CB62CC47CAED2E21950
• Submitted as: 62172458968.pdf
• File type: pdf · Size: 52328 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=swot+analysis+strengths+weaknesses+opportunities+threats+example+pdf, http://ninoju.slaglesfamilyfarm.com/uploads/1/3/0/9/130969707/muligaxet_nesizu.pdf, http://files.darknessclarified.com/uploads/1/3/0/7/130740118/76131822d39.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=swot+analysis+strengths+weaknesses+opportunities+threats+example+pdf
• http://ninoju.slaglesfamilyfarm.com/uploads/1/3/0/9/130969707/muligaxet_nesizu.pdf
• http://files.darknessclarified.com/uploads/1/3/0/7/130740118/76131822d39.pdf
• http://xinakivuf.childspacesc.com/uploads/1/3/1/0/131070602/sanujez.pdf
• http://dagufa.liquid-components.com/uploads/1/3/0/7/130739476/naberinemugobimifix.pdf
• http://files.marycampbell.net/uploads/1/3/0/8/130814112/79f343a2.pdf
• https://uploads.strikinglycdn.com/files/01ea0bea-575a-4c01-a1a1-d71aa70300bf/29644514378.pdf
• https://uploads.strikinglycdn.com/files/e9678143-59bd-407f-9372-a3f17b88fe73/1240922819.pdf
• https://uploads.strikinglycdn.com/files/ab2b389b-baba-4589-a23f-269683c56cfa/31862788802.pdf
• https://uploads.strikinglycdn.com/files/89f11700-a0be-4f50-b602-fa87a7bd5f0c/50235846405.pdf
• https://uploads.strikinglycdn.com/files/faf38875-279d-4710-96e8-f59ef765a1a3/ramadusavesorusoketotu.pdf
• https://site-1037122.mozfiles.com/files/1037122/jupirudefuwezunexug.pdf
• https://site-1036676.mozfiles.com/files/1036676/77575992471.pdf
• https://site-1037054.mozfiles.com/files/1037054/jigavusoragugogerodexizi.pdf
• https://site-1036965.mozfiles.com/files/1036965/nafizadisimum.pdf
• https://site-1036894.mozfiles.com/files/1036894/kulofig.pdf
• http://tanogujo.customchalksigns.com/uploads/1/3/0/7/130776035/kukixaju.pdf
• http://wotutola.999fm.net/uploads/1/3/1/8/131856281/jagux-jukak.pdf
• http://sajiraw.sandydex.com/uploads/1/3/1/8/131857445/989866.pdf
• http://muzulu.waitsfieldchildrenscenter.org/uploads/1/3/1/4/131437508/df2fa6515.pdf
• http://files.robertmizzi.com/uploads/1/3/1/4/131406412/nekapexafose_sepemewidaxob.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• gettraff.ru
• ninoju.slaglesfamilyfarm.com
• files.darknessclarified.com
• xinakivuf.childspacesc.com
• dagufa.liquid-components.com
• files.marycampbell.net
• uploads.strikinglycdn.com
• site-1037122.mozfiles.com
• site-1036676.mozfiles.com
• site-1037054.mozfiles.com
• site-1036965.mozfiles.com
• site-1036894.mozfiles.com
• tanogujo.customchalksigns.com
• wotutola.999fm.net
• sajiraw.sandydex.com
• muzulu.waitsfieldchildrenscenter.org
• files.robertmizzi.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report