MALICIOUS — e948c1_6478a49573dc47ae9fc6883ac43b2425.pdf

MALICIOUS — e948c1_6478a49573dc47ae9fc6883ac43b2425.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 2af31e440238f325d8fc5e4ae37bf4d4963dd6c1c961154fc57012e7833631c2
• SHA-1: b4c1b991eb7124d393d1157265eac1329eadf7a7
• MD5: 25306641d0f016fbdff3611a52330dcf
• ssdeep: 768:KgGzpDwoIS9BxONhhy7C1tCglVjunWzDuHQJvB8UXQy2V:XGFEo16YmaglhunWXuwJpQy2V
• TLSH: T14A31AEF31067DC8C75869B17A9AB105DA081E7896032A62408EC776CC87C3BEBE11E30
• Submitted as: e948c1_6478a49573dc47ae9fc6883ac43b2425.pdf
• File type: pdf · Size: 42581 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=hero+wars+mod+apk+1.81.8, https://b9a170ca-88b0-463f-be9f-e286798f7634.filesusr.com/ugd/3225da_ea9d320f23584f60a3c8e7b075cc14dd.pdf?index=true, https://3d8d954d-e23b-4049-a597-531d0ba7570a.filesusr.com/ugd/7be1cd_6922391ec714455ca7bd922ceab97f5a.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=hero+wars+mod+apk+1.81.8
• https://b9a170ca-88b0-463f-be9f-e286798f7634.filesusr.com/ugd/3225da_ea9d320f23584f60a3c8e7b075cc14dd.pdf?index=true
• https://3d8d954d-e23b-4049-a597-531d0ba7570a.filesusr.com/ugd/7be1cd_6922391ec714455ca7bd922ceab97f5a.pdf?index=true
• https://ff878c9e-c8ae-46ff-a56a-8d379a180c2f.filesusr.com/ugd/d2759c_08bb7b94988b44b4a71b38c3cf21df8d.pdf?index=true
• https://9e2221e0-3d5d-4899-a223-8096abd02f65.filesusr.com/ugd/7be1cd_7065967ca71b4981808d27ab613ed1f2.pdf?index=true
• https://1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com/ugd/227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf?index=true
• http://files.spicycharlies.com/uploads/1/3/2/6/132695408/9262730.pdf
• http://weseni.blessedvirginmaryparishwpg.ca/uploads/1/3/2/8/132815094/bidudumego.pdf
• https://17402081-7351-4a1d-b1ce-c3cc6fa22c55.filesusr.com/ugd/eb6612_d173924c5a2a457ab6723522517c80d7.pdf?index=true
• https://a723e379-7bd7-4e78-b209-01995b3812f2.filesusr.com/ugd/d2759c_950101b1958041b0a7b4080117a9ba4e.pdf?index=true
• https://0bb3ac2e-fc34-4800-9b08-a47dbcbb31a0.filesusr.com/ugd/dcc11b_eb8b4523fb1d4cf08660d9d72d9c904e.pdf?index=true
• https://a81b5e03-8442-4e7e-9adf-1dd2fe23e1df.filesusr.com/ugd/696117_96d6590406574ad4ab3417015b7dc86e.pdf?index=true
• https://cdn.shopify.com/s/files/1/0438/7173/1880/files/bible_quiz.pdf
• https://cdn.shopify.com/s/files/1/0480/7488/3236/files/12281929509.pdf
• https://cdn.shopify.com/s/files/1/0437/4098/7543/files/xivuk.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• b9a170ca-88b0-463f-be9f-e286798f7634.filesusr.com
• 3d8d954d-e23b-4049-a597-531d0ba7570a.filesusr.com
• ff878c9e-c8ae-46ff-a56a-8d379a180c2f.filesusr.com
• 9e2221e0-3d5d-4899-a223-8096abd02f65.filesusr.com
• 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
• files.spicycharlies.com
• weseni.blessedvirginmaryparishwpg.ca
• 17402081-7351-4a1d-b1ce-c3cc6fa22c55.filesusr.com
• a723e379-7bd7-4e78-b209-01995b3812f2.filesusr.com
• 0bb3ac2e-fc34-4800-9b08-a47dbcbb31a0.filesusr.com
• a81b5e03-8442-4e7e-9adf-1dd2fe23e1df.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report