MALICIOUS — d5d855_b2dbba74657b421589f8ab5ac8b28586.pdf

MALICIOUS — d5d855_b2dbba74657b421589f8ab5ac8b28586.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 3550f0709bb4e45209ef915adf73b796fab7d37bd09cb786b84d3a6df3b91338
• SHA-1: 57c057dbaf842ef71e4c78761ecaa944e0789ea2
• MD5: ec12fceb364bdd942575e14ba4689a29
• ssdeep: 768:0gGzpDcCCPjTE/t227isQtkShInVKRLNW2TmdHnThXJIzcbFtfZMH689:BGF4b8LzHjyLNW2Tmln5dbFlWH689
• TLSH: T1CC32AEF750A7EDCCB68A9F037EAA10596145C78A7122A7B059C8773CD07C6FC6E50620
• Submitted as: d5d855_b2dbba74657b421589f8ab5ac8b28586.pdf
• File type: pdf · Size: 46202 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=subway+surf+download+pc, https://bbf9c982-ebda-41db-aef5-ae88fc670586.filesusr.com/ugd/80bfa9_0381d065b297455582a0b5057be5577d.pdf?index=true, https://fe99b54a-b682-4740-9828-dc71e237d6ef.filesusr.com/ugd/529dbf_ccfb31305f0444cfbe6abc850d37d3ba.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=subway+surf+download+pc
• https://bbf9c982-ebda-41db-aef5-ae88fc670586.filesusr.com/ugd/80bfa9_0381d065b297455582a0b5057be5577d.pdf?index=true
• https://fe99b54a-b682-4740-9828-dc71e237d6ef.filesusr.com/ugd/529dbf_ccfb31305f0444cfbe6abc850d37d3ba.pdf?index=true
• https://3d1a92a9-3bb1-4326-9dd6-79a1e845264b.filesusr.com/ugd/5bb01c_4214db3df3aa4b92958d948d230aff9c.pdf?index=true
• https://7d55ab2e-7f39-47c2-acc4-28c25295e08b.filesusr.com/ugd/3402b1_6140bd1196aa4c62aca674f6f0edfd6a.pdf?index=true
• https://031e39b9-e075-4b92-bc8c-b3573f193895.filesusr.com/ugd/c5d40f_5f6ebcae84b2460a9f132bec2a7e6151.pdf?index=true
• http://files.illie.store/uploads/1/3/2/6/132682686/dizeranatatikal-dilutomol-sokufod-lakidedipufiko.pdf
• https://afca06a4-1b84-45b6-9d93-9c32cbda57ff.filesusr.com/ugd/a32c20_b036b19b13f8456798fa20d74cd443c7.pdf?index=true
• https://0d1bbb24-aa16-42b3-80df-bff4f5d60448.filesusr.com/ugd/33ab24_0291f1b4a2c94d598b4bb5c13e66ac17.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/9395/8560/files/mathematics_word_search.pdf
• https://cdn.shopify.com/s/files/1/0462/2267/2025/files/terotinerenarumozidakito.pdf
• https://cdn.shopify.com/s/files/1/0431/4444/6118/files/analyzing_ecological_footprints_worksheet_answers.pdf
• https://cdn.shopify.com/s/files/1/0430/5158/1597/files/nivovovumozoweluminiraxul.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• bbf9c982-ebda-41db-aef5-ae88fc670586.filesusr.com
• fe99b54a-b682-4740-9828-dc71e237d6ef.filesusr.com
• 3d1a92a9-3bb1-4326-9dd6-79a1e845264b.filesusr.com
• 7d55ab2e-7f39-47c2-acc4-28c25295e08b.filesusr.com
• 031e39b9-e075-4b92-bc8c-b3573f193895.filesusr.com
• files.illie.store
• afca06a4-1b84-45b6-9d93-9c32cbda57ff.filesusr.com
• 0d1bbb24-aa16-42b3-80df-bff4f5d60448.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report