MALICIOUS — bca722_c3400aa825a84435869a36eb1a2270f1.pdf

MALICIOUS — bca722_c3400aa825a84435869a36eb1a2270f1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 2be3ad6f1a6f20bfaaa8406ad6707771f2d3d2bf6b79810cf300abba6b2e0eb3
• SHA-1: 2262ac27ecca03c5d91a86870ecd266c01312135
• MD5: 4e73023d328183a38db1de3e880a5d94
• ssdeep: 768:kKgGzpDSdTM/jv7/yJUxDoX4h4wXe5KIS3ssK6wxCGH1fOa+ctTXo3fhlwc:kXGF2ZJUlXe5KH8syx51fOahtuhlwc
• TLSH: T17E339EF31097EC4C7A8AAB436DA61559A186C7C87232AB5048CC772CD4BC2FDBF50961
• Submitted as: bca722_c3400aa825a84435869a36eb1a2270f1.pdf
• File type: pdf · Size: 49035 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=basic+needs+of+a+child+maslow, https://6e2798e3-00fb-4bfd-8fb6-3f01a7adb61d.filesusr.com/ugd/6290de_8819ec778b4b4a01ac469fdc080076ba.pdf?index=true, https://9689908e-0fad-45bf-8aeb-0a10d45b083e.filesusr.com/ugd/c638b7_b477274c49db466ca19944a44e422fa5.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=basic+needs+of+a+child+maslow
• https://6e2798e3-00fb-4bfd-8fb6-3f01a7adb61d.filesusr.com/ugd/6290de_8819ec778b4b4a01ac469fdc080076ba.pdf?index=true
• https://9689908e-0fad-45bf-8aeb-0a10d45b083e.filesusr.com/ugd/c638b7_b477274c49db466ca19944a44e422fa5.pdf?index=true
• https://925395ae-2e93-49e0-a102-3ed5d468b554.filesusr.com/ugd/aef5b7_f3d02f2652944350adaa09c13ab10d2b.pdf?index=true
• https://138b6c00-6916-4456-8ed0-5583211b2d52.filesusr.com/ugd/8acad3_6cd0c92889524c62a313493d512dba60.pdf?index=true
• https://9eebb300-474a-496e-b823-fbda9ba57a40.filesusr.com/ugd/c57cae_7b69af41473247fb8c153f8413398cb1.pdf?index=true
• http://files.allieetoile.com/uploads/1/3/0/7/130738779/lelorabuxi.pdf
• http://files.amadistrict37.org/uploads/1/3/0/8/130873839/pugunutafojudawakowa.pdf
• http://files.elizabethwoodrum.com/uploads/1/3/1/4/131453522/folobajosejurasasa.pdf
• http://tinofo.chellesglitzandglamshop.com/uploads/1/3/0/8/130874457/tasadugodaneli.pdf
• http://files.rootshairsalonhorsham.com/uploads/1/3/0/9/130969461/wafiwigikavupax-sapiwikewulabi.pdf
• https://cdn.shopify.com/s/files/1/0440/6145/8597/files/incantations_orchestra_sheet_music.pdf
• https://cdn.shopify.com/s/files/1/0432/6175/5555/files/69952000255.pdf
• https://cdn.shopify.com/s/files/1/0433/4963/9327/files/bollywood_movies_sites_new.pdf
• https://cdn.shopify.com/s/files/1/0434/8598/6982/files/xeliberubibo.pdf
• https://cdn.shopify.com/s/files/1/0483/7051/6128/files/nebenexubowo.pdf
• https://78b4f21e-2595-4ffc-9d88-bb3e577f853b.filesusr.com/ugd/8c0e65_77497eb043e946608ce5c8aa6acf8d73.pdf?index=true
• https://bbdba7c9-f48a-48b4-a0f3-7c51e23ff68c.filesusr.com/ugd/eb5a6a_9d26565252ac48b6befda7baffb66a87.pdf?index=true
• https://c1b7074b-f06d-4c39-9b01-58262451d52b.filesusr.com/ugd/3f8d85_965d8637e1574945800d84d7922f256c.pdf?index=true
• https://2ea1f0ed-0614-4071-94b8-61c5b6b61f8c.filesusr.com/ugd/e2b09b_9206c4f45c6e4c64a4b8240f9b3b71d7.pdf?index=true
• https://06e89dc1-5b57-4e53-baf3-f74bb1a3b053.filesusr.com/ugd/a32c20_8b40c3c0f6474f31acfe57209aa9496d.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/

Embedded domains

• ttraff.link
• 6e2798e3-00fb-4bfd-8fb6-3f01a7adb61d.filesusr.com
• 9689908e-0fad-45bf-8aeb-0a10d45b083e.filesusr.com
• 925395ae-2e93-49e0-a102-3ed5d468b554.filesusr.com
• 138b6c00-6916-4456-8ed0-5583211b2d52.filesusr.com
• 9eebb300-474a-496e-b823-fbda9ba57a40.filesusr.com
• files.allieetoile.com
• files.amadistrict37.org
• files.elizabethwoodrum.com
• tinofo.chellesglitzandglamshop.com
• files.rootshairsalonhorsham.com
• cdn.shopify.com
• 78b4f21e-2595-4ffc-9d88-bb3e577f853b.filesusr.com
• bbdba7c9-f48a-48b4-a0f3-7c51e23ff68c.filesusr.com
• c1b7074b-f06d-4c39-9b01-58262451d52b.filesusr.com
• 2ea1f0ed-0614-4071-94b8-61c5b6b61f8c.filesusr.com
• 06e89dc1-5b57-4e53-baf3-f74bb1a3b053.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report