MALICIOUS — 28146e_c2d821e4aaac4ecf93579861aa6279cf.pdf

MALICIOUS — 28146e_c2d821e4aaac4ecf93579861aa6279cf.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 356b6000de8482226fe93c1a5d366fe2ea50f8f6b307039f175e1a06c0e35f74
SHA-1: 1a897541571dfbc185d855fd4d57eebd4a669e65
MD5: d3c2d0c4d668302128da1ec15ce275cf
ssdeep: 768:XgGzpDeXZx2fH4z1MIhGjwhBB+fMYQ2rm1opsN7qYNFajrhutz:wGFyJLyMZ+fG2rfeN7qYNUfhutz
TLSH: T16C32BFF35047ED8C3A866B03ACAB019C2589D78D313793A019D87F6CD8786BD6F11961
Submitted as: 28146e_c2d821e4aaac4ecf93579861aa6279cf.pdf
File type: pdf · Size: 44139 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.club/wix?keyword=trane+cvhf+parts+manual, https://cdn.shopify.com/s/files/1/0483/3470/0694/files/wade_organic_chemistry_9th_edition_solutions_manual.pdf, https://cdn.shopify.com/s/files/1/0434/4990/9415/files/zemizewukisotazumejug.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.club/wix?keyword=trane+cvhf+parts+manual
https://cdn.shopify.com/s/files/1/0483/3470/0694/files/wade_organic_chemistry_9th_edition_solutions_manual.pdf
https://cdn.shopify.com/s/files/1/0434/4990/9415/files/zemizewukisotazumejug.pdf
https://cdn.shopify.com/s/files/1/0430/9801/3863/files/72167248104.pdf
https://cdn.shopify.com/s/files/1/0430/9552/3485/files/nofifekelirimoli.pdf
https://f3d65c45-b73b-4750-ad71-59c60091f19f.filesusr.com/ugd/76aeb6_3517230e64d04b87a9c0fee9419ce4a7.pdf?index=true
https://5dcc58f3-5b8c-40a3-be95-8d8ab32bb9fd.filesusr.com/ugd/9904c2_54b4eac0153448a18a5532eb64d73e01.pdf?index=true
https://38c1e54f-a2ac-4115-8c62-4556a013a174.filesusr.com/ugd/c8f33b_2029556fa2fd40c5b9e7aeff86b3a8c7.pdf?index=true
https://9f3d9d25-7df2-4978-a3f2-a15ed3297399.filesusr.com/ugd/3ed902_92d9df35903443d08e14c4d78cbb8d20.pdf?index=true
https://e339f6b3-5af1-4216-be43-c6b99f9ac500.filesusr.com/ugd/70e7d4_175a704a4c164ab098f23a609d91a42c.pdf?index=true
http://files.erainnawinnett.com/uploads/1/3/1/3/131398555/sijis.pdf
http://kikokozid.totaltechwv.com/uploads/1/3/1/0/131070374/xomef.pdf
https://cdn.shopify.com/s/files/1/0436/1653/4690/files/dajumagiboliwapowirobekuw.pdf
https://cdn.shopify.com/s/files/1/0436/1024/3229/files/tijikorojixodekubak.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.club
cdn.shopify.com
f3d65c45-b73b-4750-ad71-59c60091f19f.filesusr.com
5dcc58f3-5b8c-40a3-be95-8d8ab32bb9fd.filesusr.com
38c1e54f-a2ac-4115-8c62-4556a013a174.filesusr.com
9f3d9d25-7df2-4978-a3f2-a15ed3297399.filesusr.com
e339f6b3-5af1-4216-be43-c6b99f9ac500.filesusr.com
files.erainnawinnett.com
kikokozid.totaltechwv.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report