MALICIOUS — 45fd81_be09878fdae14047aff6b81bc691e6c7.pdf

MALICIOUS — 45fd81_be09878fdae14047aff6b81bc691e6c7.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 3f9d988be6aabfc4e1f1fabedeb7063984c66a74e78c8c16b544ce6751502873
• SHA-1: 75d2779a9776f02eb2665a29b67636c3eff9d4c6
• MD5: 549b783eb7ce3a39ee91a313ab47fcf9
• ssdeep: 768:AgGzpDYCYWjYidmJoVFKVJa7F/7dgnJZXOxKZ9y7n1jTybgiMsXxOh9dm5Sie:NGFUCYWjTdmJeFKjygrOxKZA1vypPSie
• TLSH: T16A33BFF351B7DD4C7697AF03ADFA2595A440E648A523A36051C87B2CC4BC3FCAE44A50
• Submitted as: 45fd81_be09878fdae14047aff6b81bc691e6c7.pdf
• File type: pdf · Size: 48377 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=dylan%2527s+unblocked+games+mario+kart, https://29b5993a-e9c0-4f8e-af93-6ed027d30e9e.filesusr.com/ugd/cc3ca9_674575c3d95b42bda2bc19c9c717aed4.pdf?index=true, https://139f3622-7e67-425b-8023-d63b8c2d2ec8.filesusr.com/ugd/6f9b04_e2125b570bbb4d83891219f938050712.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=dylan%2527s+unblocked+games+mario+kart
• https://29b5993a-e9c0-4f8e-af93-6ed027d30e9e.filesusr.com/ugd/cc3ca9_674575c3d95b42bda2bc19c9c717aed4.pdf?index=true
• https://139f3622-7e67-425b-8023-d63b8c2d2ec8.filesusr.com/ugd/6f9b04_e2125b570bbb4d83891219f938050712.pdf?index=true
• https://9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com/ugd/3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf?index=true
• http://suset.ardenemil.com/uploads/1/3/0/9/130969162/vujitifemewat.pdf
• http://kokisujos.lightpathdiscoverycenter.com/uploads/1/3/2/6/132681361/6764999.pdf
• http://bilebodip.dragonmoononline.com.au/uploads/1/3/0/8/130814328/6146455.pdf
• http://wuten.pulsearts.org/uploads/1/3/1/8/131871787/lolatirajizobapinu.pdf
• http://minatiluz.las-philosophy.com/uploads/1/3/1/8/131855981/4843230.pdf
• https://96d2bf39-8a2b-4e07-a626-8300d86fa5d4.filesusr.com/ugd/035627_c842ea8938fc49a89f66b25ed8ef91ef.pdf?index=true
• https://41c63069-00c6-4cc7-953d-70300bce185b.filesusr.com/ugd/c5d40f_980422cf832d4895be9f6cb3d241fc34.pdf?index=true
• https://67e9317f-b2d8-440a-9734-40aef0f61b9c.filesusr.com/ugd/0d018b_906bf9564efd4861a41c18938caa9986.pdf?index=true
• https://cd5b3bea-4d0a-4bfd-864f-0a07bd623901.filesusr.com/ugd/fd4c29_517e826c13e24aa2908656ef03a582e3.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 29b5993a-e9c0-4f8e-af93-6ed027d30e9e.filesusr.com
• 139f3622-7e67-425b-8023-d63b8c2d2ec8.filesusr.com
• 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com
• suset.ardenemil.com
• kokisujos.lightpathdiscoverycenter.com
• bilebodip.dragonmoononline.com.au
• wuten.pulsearts.org
• minatiluz.las-philosophy.com
• 96d2bf39-8a2b-4e07-a626-8300d86fa5d4.filesusr.com
• 41c63069-00c6-4cc7-953d-70300bce185b.filesusr.com
• 67e9317f-b2d8-440a-9734-40aef0f61b9c.filesusr.com
• cd5b3bea-4d0a-4bfd-864f-0a07bd623901.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report