MALICIOUS — 217b8a_e986bedddca7408496cc250831a71ec5.pdf

MALICIOUS — 217b8a_e986bedddca7408496cc250831a71ec5.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 2ff7fca6629bed12bc647be098964b8a64f812f48067b43ceb598502193c992e
• SHA-1: ce7e49927a79f2f320bc07e20d64be7b88421296
• MD5: 53288956b0b7f4cc3c70de9fbcdec224
• ssdeep: 768:egGzpDrg1AGPUbHioU/2wGI79ICX+9Bx7msup9gb0Jve7DV:bGFvg1hR9IE+937mVJm7DV
• TLSH: T119308DF35097ED8C368F6B039EAB145DA085D74CA022A39059DC3B6CD0BCBED6E40661
• Submitted as: 217b8a_e986bedddca7408496cc250831a71ec5.pdf
• File type: pdf · Size: 39135 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=crystal+shop+colorado+springs, https://100e3710-0fa1-41cb-ada9-bd15de84e0bb.filesusr.com/ugd/d38238_9bdf05ccbfc74d0cbdc6c14436c66f57.pdf?index=true, https://87bd2be3-48db-45d5-b646-fa34ed482961.filesusr.com/ugd/21e9e0_5e2c0fda02294aeca6fc14352a2fd1e1.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=crystal+shop+colorado+springs
• https://100e3710-0fa1-41cb-ada9-bd15de84e0bb.filesusr.com/ugd/d38238_9bdf05ccbfc74d0cbdc6c14436c66f57.pdf?index=true
• https://87bd2be3-48db-45d5-b646-fa34ed482961.filesusr.com/ugd/21e9e0_5e2c0fda02294aeca6fc14352a2fd1e1.pdf?index=true
• https://a09b8751-affe-430f-a842-7957a58a16e4.filesusr.com/ugd/7f614e_b3459a76b96e408bb900dcd450005542.pdf?index=true
• https://273a9602-0f4a-479c-a89a-812a741fd839.filesusr.com/ugd/529dbf_83d08c21399946a18938f073f76e236c.pdf?index=true
• https://10f75c3a-4b2d-4bdc-a400-f46a1b872b40.filesusr.com/ugd/57c819_1a3cbd8a04a945c2a9c46daac14e73a4.pdf?index=true
• https://cdn.shopify.com/s/files/1/0481/8544/2453/files/uber_police_verification_form_chandigarh.pdf
• https://cdn.shopify.com/s/files/1/0428/2312/3100/files/jigizajutup.pdf
• https://cdn.shopify.com/s/files/1/0434/3745/7575/files/mabupulugid.pdf
• https://cdn.shopify.com/s/files/1/0438/9899/4856/files/xiwarozejivibusabegume.pdf
• http://luduzof.oxfordfamilyhypnotherapy.co.uk/uploads/1/3/2/6/132682565/ffe303c.pdf
• http://gegunij.dukecaldwell.com/uploads/1/3/0/8/130814340/feweva.pdf
• http://lojiwop.candalariapta.org/uploads/1/3/2/6/132681333/5155173.pdf
• http://files.mnreynoldsphotography.com/uploads/1/3/1/8/131871909/guburosoged_gosejilelukixep_tomimeka_rimajefijotone.pdf
• http://files.bertram-hill.com/uploads/1/3/2/6/132696210/poretuwinowabik_vavazos.pdf
• https://cdn.shopify.com/s/files/1/0437/6811/9453/files/2862255676.pdf
• https://cdn.shopify.com/s/files/1/0430/6645/8265/files/rotupuwoxivilemixenome.pdf
• https://cdn.shopify.com/s/files/1/0429/9482/7418/files/44348056107.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 100e3710-0fa1-41cb-ada9-bd15de84e0bb.filesusr.com
• 87bd2be3-48db-45d5-b646-fa34ed482961.filesusr.com
• a09b8751-affe-430f-a842-7957a58a16e4.filesusr.com
• 273a9602-0f4a-479c-a89a-812a741fd839.filesusr.com
• 10f75c3a-4b2d-4bdc-a400-f46a1b872b40.filesusr.com
• cdn.shopify.com
• luduzof.oxfordfamilyhypnotherapy.co.uk
• gegunij.dukecaldwell.com
• lojiwop.candalariapta.org
• files.mnreynoldsphotography.com
• files.bertram-hill.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report