MALICIOUS — 234f58_fd7b476064564cba9c89c593fad06796.pdf

MALICIOUS — 234f58_fd7b476064564cba9c89c593fad06796.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 499ca4970c1aae7f91b92bb21ee1e5a845689aa7e0d49795561a3846d95c8d3b
• SHA-1: f31c50c90a42b82e76670ebdbdd23bd057f12de4
• MD5: 22e59f720e226b95e69cb8e0dd436805
• ssdeep: 768:ugGzpDChptFek+Eghkb0WQn5CtgQkPwDdrHS7AFjXXvqZo4oBqvgwlijT3XWcxjx:LGFG5gWQ0OKFy8xmBowlEbXWcxjGjPGb
• TLSH: T1F232AEF340A3ED8C7F8E5B43AEA6114A604AD38C6137A65149CC772CD4BCAFD6E10621
• Submitted as: 234f58_fd7b476064564cba9c89c593fad06796.pdf
• File type: pdf · Size: 46024 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=rc+tractor+pull, https://cdn.shopify.com/s/files/1/0431/2884/8538/files/e_waste_management_in_marathi.pdf, https://cdn.shopify.com/s/files/1/0437/4737/7301/files/renault_can_clip_manual.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=rc+tractor+pull
• https://cdn.shopify.com/s/files/1/0431/2884/8538/files/e_waste_management_in_marathi.pdf
• https://cdn.shopify.com/s/files/1/0437/4737/7301/files/renault_can_clip_manual.pdf
• https://cdn.shopify.com/s/files/1/0427/4431/6070/files/zibelebuduviwojudujekupa.pdf
• https://cdn.shopify.com/s/files/1/0433/6828/4319/files/nice_guidelines_bronchiolitis.pdf
• http://files.crispusattucksalumnilettermen.com/uploads/1/3/0/7/130740391/wapenitodebi.pdf
• http://files.whiteimprints.com/uploads/1/3/2/7/132740253/efe5f473c1.pdf
• http://files.hotstuffromance.com/uploads/1/3/0/7/130739190/1965456.pdf
• http://files.larrylroberson.com/uploads/1/3/1/4/131455621/9301201.pdf
• https://0d89c631-fc67-4995-b91f-bb2d2752d0d2.filesusr.com/ugd/ceb2e8_cf6e49671beb49bab89d96dcb5dcd37f.pdf?index=true
• https://0e8815c1-8e71-4c07-8f59-58e09e4d9b6a.filesusr.com/ugd/70e7d4_1f5129e47a1f4e9cb7cce1f760a24b49.pdf?index=true
• https://79e80f0d-d3ce-46b5-886d-2323353f689f.filesusr.com/ugd/501a20_008cb17de2da4968a6c40ab1b2c823d3.pdf?index=true
• https://48172e3e-c47f-4aae-9af0-3c8f51bfefcf.filesusr.com/ugd/9c8fb9_e2c935590ce34fb5b2733e2af8698087.pdf?index=true
• https://dd4ec644-9bb5-42d4-ad11-335276008e78.filesusr.com/ugd/6116da_9e32ce73ba304f4ea3e63160e2c140a4.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/8678/2369/files/predator_prey_relations_and_invasive_species_virtual_lab_answers.pdf
• https://cdn.shopify.com/s/files/1/0434/9201/6280/files/vuruvifibujevidixakikevu.pdf
• https://cdn.shopify.com/s/files/1/0428/1411/1903/files/estratgias_de_marketing_digital_e_e_commerce_livro.pdf
• https://cdn.shopify.com/s/files/1/0434/0855/6182/files/zufavuketewazadoxax.pdf
• https://cdn.shopify.com/s/files/1/0432/8531/5739/files/naxowe.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• cdn.shopify.com
• files.crispusattucksalumnilettermen.com
• files.whiteimprints.com
• files.hotstuffromance.com
• files.larrylroberson.com
• 0d89c631-fc67-4995-b91f-bb2d2752d0d2.filesusr.com
• 0e8815c1-8e71-4c07-8f59-58e09e4d9b6a.filesusr.com
• 79e80f0d-d3ce-46b5-886d-2323353f689f.filesusr.com
• 48172e3e-c47f-4aae-9af0-3c8f51bfefcf.filesusr.com
• dd4ec644-9bb5-42d4-ad11-335276008e78.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report