MALICIOUS — 72765857149.pdf

MALICIOUS — 72765857149.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 1ee1503ecf1c513223ac2bc225f81df1a4e138f63e77c711d0c20d96e18f5317
• SHA-1: b6838b9d14305dd6a042975529e8d6c03f520e4c
• MD5: 516be3a371949348924316973b0f123b
• ssdeep: 1536:OGFodreAlcuY4Uk2yfPw2ZhDW8viIAdFbZF:3FolvlnAkPnwkvKIAbbX
• TLSH: T14D33BEF340ABFE8C7A8B9B43A8EB00592546C7885137A75045D83B2CC5B86FDBD51DA0
• Submitted as: 72765857149.pdf
• File type: pdf · Size: 51435 bytes
• Verdict: malicious (70/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=badlapur+mp4+movie+download+2015, https://cdn.shopify.com/s/files/1/0480/9526/4932/files/entry_level_technical_writer_remote_jobs.pdf, https://cdn.shopify.com/s/files/1/0495/8696/2582/files/whatsapp_apk_mod_android_1.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=badlapur+mp4+movie+download+2015
• https://cdn.shopify.com/s/files/1/0480/9526/4932/files/entry_level_technical_writer_remote_jobs.pdf
• https://cdn.shopify.com/s/files/1/0495/8696/2582/files/whatsapp_apk_mod_android_1.pdf
• https://cdn.shopify.com/s/files/1/0433/2834/0123/files/black_dragon_wyrmling.pdf
• https://cdn.shopify.com/s/files/1/0479/1674/4870/files/fujukupatijisajifobamizut.pdf
• https://cdn.shopify.com/s/files/1/0431/9117/3278/files/geometry_dash_mod_apk_fast_download.pdf
• https://site-1037077.mozfiles.com/files/1037077/korirugi.pdf
• https://site-1039419.mozfiles.com/files/1039419/1116366978.pdf
• https://site-1039886.mozfiles.com/files/1039886/60930188700.pdf
• https://site-1038499.mozfiles.com/files/1038499/naxoko.pdf
• https://cdn.shopify.com/s/files/1/0429/0219/2284/files/baldwin_state_prison_milledgeville_georgia.pdf
• https://cdn.shopify.com/s/files/1/0493/1829/7759/files/coastal_wetlands_abiotic_factors.pdf
• https://cdn.shopify.com/s/files/1/0437/0874/3835/files/valejugufigib.pdf
• https://cdn.shopify.com/s/files/1/0481/6604/3801/files/words_that_start_with_letter_g_to_describe_someone.pdf
• http://files.seancotton.com/uploads/1/3/2/3/132303209/volufede.pdf
• http://wowiru.dianesestatesales.com/uploads/1/3/2/6/132683014/viremor.pdf
• http://volaw.berwickranger.com/uploads/1/3/0/9/130969633/7373927.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• cdn.shopify.com
• site-1037077.mozfiles.com
• site-1039419.mozfiles.com
• site-1039886.mozfiles.com
• site-1038499.mozfiles.com
• files.seancotton.com
• wowiru.dianesestatesales.com
• volaw.berwickranger.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report