MALICIOUS — a9248e_d863237c491d45b9b98f35cd11de487a.pdf

MALICIOUS — a9248e_d863237c491d45b9b98f35cd11de487a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

SHA-256: 33b36a3b692a7a1685d997b4057d82653337754e469551d9c5edd9f10da8b36f
SHA-1: e8fe704db465eb6a977025dfa479fb490138f612
MD5: 380bbc47c7fbce21076f9d4760955af5
ssdeep: 768:egGzpDU52gRkydfqJQi66bL96qKxVe4FCkiESEX+iDekXL7PXPXBr:bGFw5bAs6F6qoVHIqj7XL7PXPXBr
TLSH: T104329DF31097ED8C3ACA6703BCE611556096E78C6133A26462C87B7CD5783FCAE50961
Submitted as: a9248e_d863237c491d45b9b98f35cd11de487a.pdf
File type: pdf · Size: 44458 bytes
Verdict: malicious (88/100)

Detections (3 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.cc/wix?keyword=brinsfield+echols+funeral+home+md, http://mexigop.mjdemasi.com/uploads/1/3/1/0/131069759/wiwiwiveno_seleregapitesiz.pdf, http://files.stjohnsdelhi.org/uploads/1/3/0/7/130776599/wejuguxekajugin.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.cc/wix?keyword=brinsfield+echols+funeral+home+md
http://mexigop.mjdemasi.com/uploads/1/3/1/0/131069759/wiwiwiveno_seleregapitesiz.pdf
http://files.stjohnsdelhi.org/uploads/1/3/0/7/130776599/wejuguxekajugin.pdf
http://files.jacksongop.org/uploads/1/3/1/8/131871871/nubinomiwukivabif.pdf
http://files.radiolibertyky.com/uploads/1/3/1/4/131407315/6d7ce.pdf
http://zubegupi.ccmiddleeast.org/uploads/1/3/1/4/131407995/xeriwunibag.pdf
http://files.svwca.org/uploads/1/3/1/4/131437276/7627816.pdf
https://cdn.shopify.com/s/files/1/0431/1564/3042/files/avril_14th_sheet_music.pdf
https://cdn.shopify.com/s/files/1/0438/4397/7366/files/brainly_premium_apk.pdf
https://cdn.shopify.com/s/files/1/0431/3320/6682/files/27036034982.pdf
https://cdn.shopify.com/s/files/1/0432/5575/9011/files/jitikebukidaf.pdf
https://4a3dccd4-b360-428e-ba0a-68b995ea3408.filesusr.com/ugd/eaf48f_25060061a4374736b4af5da208359ab7.pdf?index=true
https://aec3de26-2d03-44c6-ba33-a0f663699a4a.filesusr.com/ugd/1cc777_9fff06e1228b4752a94f336a0d9a62f0.pdf?index=true
https://577710b0-f715-472d-b535-25e68a2a0003.filesusr.com/ugd/8ce377_498a1fa7d3c34ca69b15572061bf6625.pdf?index=true
https://dbd3c9c0-900a-4830-9e8a-e2f526370b1e.filesusr.com/ugd/6f5f23_6afaaf19dbd34e149235ecb7f7b9a5ab.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.cc
mexigop.mjdemasi.com
files.stjohnsdelhi.org
files.jacksongop.org
files.radiolibertyky.com
zubegupi.ccmiddleeast.org
files.svwca.org
cdn.shopify.com
4a3dccd4-b360-428e-ba0a-68b995ea3408.filesusr.com
aec3de26-2d03-44c6-ba33-a0f663699a4a.filesusr.com
577710b0-f715-472d-b535-25e68a2a0003.filesusr.com
dbd3c9c0-900a-4830-9e8a-e2f526370b1e.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report