MALICIOUS — 22739b_7396d1361f6048898ad1ad8190d3411e.pdf

MALICIOUS — 22739b_7396d1361f6048898ad1ad8190d3411e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 23238fe6c45327ccb7cbed532aa5b35f5e54b887fd3253df0b57dbae2f495f4d
• SHA-1: 90952be6bfc5687ebd7060a8a5d4b9d67888d030
• MD5: 112f2d60eae2b594bd91f98845b11fd9
• ssdeep: 768:8gGzpDk7RXQX5rLvVF0YwkQ3OJnbH2cXmYUcgeLeO8PIf9fJOX2r:ZGFo1AKkQ3OpbHbXmKYaf9xOX2r
• TLSH: T15C32AFF35487ED8C3A8B5B07A89621496186C689713BE7E4589C3B7CD57C2FDBE00821
• Submitted as: 22739b_7396d1361f6048898ad1ad8190d3411e.pdf
• File type: pdf · Size: 43645 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=compair+l250+compressor+manual, https://ad0a81e5-9d04-4413-92c0-d2fd14760001.filesusr.com/ugd/d6b5da_8f635c11e6a1435da46823e8a35ba156.pdf?index=true, https://e61e975e-fdb2-4c78-a538-8cc11874a25b.filesusr.com/ugd/681527_60cd934617664d06bac3e259b58632fe.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=compair+l250+compressor+manual
• https://ad0a81e5-9d04-4413-92c0-d2fd14760001.filesusr.com/ugd/d6b5da_8f635c11e6a1435da46823e8a35ba156.pdf?index=true
• https://e61e975e-fdb2-4c78-a538-8cc11874a25b.filesusr.com/ugd/681527_60cd934617664d06bac3e259b58632fe.pdf?index=true
• https://1ab96ada-00a6-4e72-836c-3ecda828598e.filesusr.com/ugd/e54fc7_7eb183cc28294912a1de8897ea713f10.pdf?index=true
• https://a3b808ce-1500-4052-89ef-97ed9c6a3413.filesusr.com/ugd/a9248e_ec1d33b8b02a470d8401785d3d07817b.pdf?index=true
• https://e3fd0533-f0b9-4616-b2a3-bf9dd385096b.filesusr.com/ugd/39d081_18a80a1e1830423b9c465f2e3e181dac.pdf?index=true
• https://0a518034-25fa-406e-abac-d9d3fc5cead2.filesusr.com/ugd/2d1648_a234f54a0ba649a4b63511b63c99a09c.pdf?index=true
• https://15e1773e-045e-4b20-9909-5e19877f6661.filesusr.com/ugd/0789d5_1b258d663e304bcc8fb6df98c7155a3e.pdf?index=true
• https://cdn.shopify.com/s/files/1/0432/1814/1347/files/causes_of_american_revolution_worksheet.pdf
• https://cdn.shopify.com/s/files/1/0430/7727/1716/files/pefajowi.pdf
• https://cdn.shopify.com/s/files/1/0459/7006/3520/files/kariv.pdf
• https://cdn.shopify.com/s/files/1/0432/6447/5299/files/bhagwan_photo_karo.pdf
• https://cdn.shopify.com/s/files/1/0482/3705/2058/files/24011107055.pdf
• https://cdn.shopify.com/s/files/1/0435/6990/5825/files/82330341775.pdf
• https://cdn.shopify.com/s/files/1/0432/8819/9328/files/nizujaged.pdf
• https://cdn.shopify.com/s/files/1/0433/4167/6694/files/tudasodozupukewoxuv.pdf
• https://cdn.shopify.com/s/files/1/0437/8204/5853/files/ocr_a_level_sociology_textbook_answers.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• ad0a81e5-9d04-4413-92c0-d2fd14760001.filesusr.com
• e61e975e-fdb2-4c78-a538-8cc11874a25b.filesusr.com
• 1ab96ada-00a6-4e72-836c-3ecda828598e.filesusr.com
• a3b808ce-1500-4052-89ef-97ed9c6a3413.filesusr.com
• e3fd0533-f0b9-4616-b2a3-bf9dd385096b.filesusr.com
• 0a518034-25fa-406e-abac-d9d3fc5cead2.filesusr.com
• 15e1773e-045e-4b20-9909-5e19877f6661.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report