MALICIOUS — 1595322895.pdf

MALICIOUS — 1595322895.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 2b851db5b93d278bd5c6a5e8ff4b015fad5ea5790d33d6ad19743c1862a81c7a
SHA-1: d37d8ed02debf3fb317d6d85505ae015911cab92
MD5: 6c881a756170e0f39f298940c33deb8b
ssdeep: 768:hgGzpDSn+cio8glYxM1q10HYAFmY8Nlmh:SGFkpwMM10HYAFwNlmh
TLSH: T1E7305CF31067EC8D7A8BAF036EAB24985146C38D6026D3A059DD762CD47C6BD6E10960
Submitted as: 1595322895.pdf
File type: pdf · Size: 36513 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://gettraff.ru/strik?keyword=atlas+of+electrocardiography+k+wang+pdf, https://cdn.shopify.com/s/files/1/0448/3871/5552/files/usps_practice_test.pdf, https://cdn.shopify.com/s/files/1/0433/4636/2533/files/kudekuwovopi.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://gettraff.ru/strik?keyword=atlas+of+electrocardiography+k+wang+pdf
https://cdn.shopify.com/s/files/1/0448/3871/5552/files/usps_practice_test.pdf
https://cdn.shopify.com/s/files/1/0433/4636/2533/files/kudekuwovopi.pdf
https://cdn.shopify.com/s/files/1/0440/2947/7014/files/craig_bluetooth_speaker_review.pdf
https://cdn.shopify.com/s/files/1/0433/5101/5577/files/bulelovalifeletaku.pdf
http://tivoj.aqeek.com/uploads/1/3/1/0/131071145/wemadubivudejo.pdf
http://files.preschoolcorner.com/uploads/1/3/0/8/130873930/zawilorifofilaj.pdf
http://wepabewo.londonsustainableschools.org/uploads/1/3/0/9/130969114/c699ae2c74066be.pdf
http://xejolasu.aittransmission.com/uploads/1/3/2/6/132681490/4755927.pdf
https://site-1037222.mozfiles.com/files/1037222/36994105853.pdf
https://site-1037187.mozfiles.com/files/1037187/vazujibegovafiseli.pdf
https://site-1037022.mozfiles.com/files/1037022/50944837262.pdf
https://site-1036981.mozfiles.com/files/1036981/valunadedavipa.pdf
https://site-1036951.mozfiles.com/files/1036951/49299516826.pdf
http://xosabi.lyrikalstorm.org/uploads/1/3/1/3/131378960/modotomukesilozemoxe.pdf
http://files.missamericanprestige.com/uploads/1/3/2/7/132711999/zuniladonunix.pdf
http://files.beinghumaninstem.com/uploads/1/3/1/3/131379510/xenap.pdf
http://files.adameccleston.net/uploads/1/3/1/4/131411596/1394e81fcefd8c2.pdf
http://files.aaandc.org/uploads/1/3/1/3/131381103/4253755.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

gettraff.ru
cdn.shopify.com
tivoj.aqeek.com
files.preschoolcorner.com
wepabewo.londonsustainableschools.org
xejolasu.aittransmission.com
site-1037222.mozfiles.com
site-1037187.mozfiles.com
site-1037022.mozfiles.com
site-1036981.mozfiles.com
site-1036951.mozfiles.com
xosabi.lyrikalstorm.org
files.missamericanprestige.com
files.beinghumaninstem.com
files.adameccleston.net
files.aaandc.org
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report