MALICIOUS — c88839_260a1bc65bd641108e681571b6a80b32.pdf

MALICIOUS — c88839_260a1bc65bd641108e681571b6a80b32.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 2efd547903cac91fb7e82d7e80aab04498494569536989fbbfe171ebf74528c8
• SHA-1: 02a0f980216ba3a5375ddefb620f3135960edaeb
• MD5: 24509dc9506a429d06cc69d9b05d7136
• ssdeep: 768:tgGzpDfLjhSnr9A8bY17NHgmScrOMryDeL/jOJvi:OGFL/hfpAVMryDGCJvi
• TLSH: T14832AEF35097EC8CBA9BAF47AEAB05895449C7897136976084CC77ACC0BC6FD5E10A10
• Submitted as: c88839_260a1bc65bd641108e681571b6a80b32.pdf
• File type: pdf · Size: 44710 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=spider+man+trophy+guide+in+order, http://files.iapicca.ch/uploads/1/3/1/4/131484029/wevuroka-ximov-pabarurelo.pdf, http://files.industrysitesonline.com/uploads/1/3/1/8/131856331/xexuninoku.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=spider+man+trophy+guide+in+order
• http://files.iapicca.ch/uploads/1/3/1/4/131484029/wevuroka-ximov-pabarurelo.pdf
• http://files.industrysitesonline.com/uploads/1/3/1/8/131856331/xexuninoku.pdf
• http://tozebinok.aurora-patina.com/uploads/1/3/0/8/130813042/7377081.pdf
• http://files.hccflmetz.com/uploads/1/3/1/3/131379054/doviwo-tegirapu-vudaf.pdf
• http://files.calphotographs.com/uploads/1/3/1/4/131483201/5257787.pdf
• http://sisonagiz.marksmotivation.org/uploads/1/3/1/8/131872155/gemataxi.pdf
• http://bafow.diaolab.org/uploads/1/3/0/7/130739883/9c13c3e74.pdf
• http://gunavux.jenroweaicp.com/uploads/1/3/2/7/132741100/bapimoj-didivopefum-sapiduraju-wiwejakidexof.pdf
• http://mojos.utecarbone.com/uploads/1/3/2/7/132740780/a5c6b.pdf
• http://files.vanfleetcleaningservices.com/uploads/1/3/2/3/132303353/9099779.pdf
• http://wamozemom.lccommunityradio.org/uploads/1/3/0/7/130775734/a92e57b73adb4.pdf
• http://files.jokittsyoga.com/uploads/1/3/1/3/131379671/7967994.pdf
• https://2e8324ae-7bf4-4552-883f-f120bf41d836.filesusr.com/ugd/34e21e_93eb1507e07e4196850759726a3270ee.pdf?index=true
• https://717e4c30-0dff-4909-81d8-a017635d07b1.filesusr.com/ugd/7f46b5_6672960abe4d41869301262c97528253.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• files.iapicca.ch
• files.industrysitesonline.com
• tozebinok.aurora-patina.com
• files.hccflmetz.com
• files.calphotographs.com
• sisonagiz.marksmotivation.org
• bafow.diaolab.org
• gunavux.jenroweaicp.com
• mojos.utecarbone.com
• files.vanfleetcleaningservices.com
• wamozemom.lccommunityradio.org
• files.jokittsyoga.com
• 2e8324ae-7bf4-4552-883f-f120bf41d836.filesusr.com
• 717e4c30-0dff-4909-81d8-a017635d07b1.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report