MALICIOUS — d2759c_e9daea5e7ef942e88b4c757bbae49e22.pdf

MALICIOUS — d2759c_e9daea5e7ef942e88b4c757bbae49e22.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 23f91cece93e0ad96f9a2eb3f7b84502be17ae705269ea66a1f5490be9ffd2ad
• SHA-1: c9ad37c40f85d4b97a345cd57ea5e11ce91ed90f
• MD5: 8f80ec52e7248d7a8fc6b9efae615e5e
• ssdeep: 768:KgGzpDtYQPlDK28mqEmLmsfWCQth3ZdADXgjXHMx6K/6:XGFRnLqmzALgjXrK/6
• TLSH: T141319EF390EBEC4C6A969B036AEA10586085D3CC2233D274999C777CC4B87BC6E51971
• Submitted as: d2759c_e9daea5e7ef942e88b4c757bbae49e22.pdf
• File type: pdf · Size: 41193 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=lodi+unified+school+district+schedule+2018, https://cdn.shopify.com/s/files/1/0434/1871/4264/files/46020589831.pdf, https://cdn.shopify.com/s/files/1/0434/9100/0472/files/south_charleston_high_school_logo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=lodi+unified+school+district+schedule+2018
• https://cdn.shopify.com/s/files/1/0434/1871/4264/files/46020589831.pdf
• https://cdn.shopify.com/s/files/1/0434/9100/0472/files/south_charleston_high_school_logo.pdf
• https://cdn.shopify.com/s/files/1/0434/6744/0294/files/latest_bhojpuri_movie_song_biharmasti._in.pdf
• http://mitew.magicaladventurestravelwithjennifer.com/uploads/1/3/1/4/131482975/67cc00.pdf
• http://neraxiwut.giacondaltd.com/uploads/1/3/0/8/130873995/nuxejusewi.pdf
• https://e338e107-af11-4e7c-ac58-3023ac87b2aa.filesusr.com/ugd/682d1c_be11a56debcf49efa841cfac19c1c0ef.pdf?index=true
• https://413d6933-354a-4c84-a91a-40189b9a0322.filesusr.com/ugd/dcc11b_011f9c2e872541c0a862c60afe70cf3b.pdf?index=true
• https://a0ccc12d-047c-4706-aaf1-b3e77c3bd8b9.filesusr.com/ugd/610d21_75961537611745f0987d67db48c0cda3.pdf?index=true
• https://7d1c7e8f-3369-4c60-9865-e740fdaade51.filesusr.com/ugd/7be1cd_49876b9de01349c9b49636a6099e77a7.pdf?index=true
• https://6d56a461-560f-471c-a83d-c03dbf17958a.filesusr.com/ugd/5bb01c_9ecdaf0ce04d4f0cb11632ed3ff5c987.pdf?index=true
• https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true
• https://932c3435-885b-4361-8247-63414807ac8e.filesusr.com/ugd/58a813_5ba0178f60964495acddffbbf03c9245.pdf?index=true
• https://200cbb3a-f808-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/fd4c29_f8822443eeda4fc98dff82760e6ff4bd.pdf?index=true
• https://c4262956-8fe0-4d2d-b88e-b26f50d1e1f2.filesusr.com/ugd/33ab24_cd8a80e04c31465b938691bbfb89bfdf.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• cdn.shopify.com
• mitew.magicaladventurestravelwithjennifer.com
• neraxiwut.giacondaltd.com
• e338e107-af11-4e7c-ac58-3023ac87b2aa.filesusr.com
• 413d6933-354a-4c84-a91a-40189b9a0322.filesusr.com
• a0ccc12d-047c-4706-aaf1-b3e77c3bd8b9.filesusr.com
• 7d1c7e8f-3369-4c60-9865-e740fdaade51.filesusr.com
• 6d56a461-560f-471c-a83d-c03dbf17958a.filesusr.com
• 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
• 932c3435-885b-4361-8247-63414807ac8e.filesusr.com
• 200cbb3a-f808-11ea-a328-fc4dd43d38a6.filesusr.com
• c4262956-8fe0-4d2d-b88e-b26f50d1e1f2.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report