MALICIOUS — 868401_daa7f234f57c4d7490eebbcce595e526.pdf

MALICIOUS — 868401_daa7f234f57c4d7490eebbcce595e526.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 4aedac070a131dc5d458084e42e383b0c1e60f316427e963e4d6352192dd24a3
• SHA-1: d5b1c93e75050ac97e4f9cb1124a273d5eda1856
• MD5: d83851b08d04e85378dcd4ca36063139
• ssdeep: 768:GgGzpDinYYQ1t62URLodghima5RPV5txSsQoh8uJsIMb3Llj:TGF2n2iR8AIf7MGaP3Llj
• TLSH: T17F319DF3605BDD8C3A876F43ADAA1199A549CB887236626044D477ACC4BC7FD3F01921
• Submitted as: 868401_daa7f234f57c4d7490eebbcce595e526.pdf
• File type: pdf · Size: 42318 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=i+ching+pdf+espa%25C3%25B1ol, https://a88b81a3-b7b3-4a08-85d0-9f243825dde5.filesusr.com/ugd/01bc73_dae56a835f5649688ed6a3f867ce3153.pdf?index=true, https://f9e93eb7-f703-4f5b-90b9-5a452d306726.filesusr.com/ugd/3be48b_acf5469df6bd47a9b34b91aa1080a1d8.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=i+ching+pdf+espa%25C3%25B1ol
• https://a88b81a3-b7b3-4a08-85d0-9f243825dde5.filesusr.com/ugd/01bc73_dae56a835f5649688ed6a3f867ce3153.pdf?index=true
• https://f9e93eb7-f703-4f5b-90b9-5a452d306726.filesusr.com/ugd/3be48b_acf5469df6bd47a9b34b91aa1080a1d8.pdf?index=true
• https://cef96d5e-0c67-4edd-975a-5d19c8da32d2.filesusr.com/ugd/3f1130_ea20c9138a0c4a4ea080ae6574244e08.pdf?index=true
• https://3d5b0252-70c3-4101-8ee6-f43234f73917.filesusr.com/ugd/2994dd_b06afcafc960404d83404fd1bd266119.pdf?index=true
• https://adaca82c-bcdf-4b7d-9ad3-1794181a402f.filesusr.com/ugd/3283b0_0efd3362cacf41e29aa01180b9fa26a5.pdf?index=true
• http://files.enlaorillathefilm.com/uploads/1/3/0/8/130874067/4d03d856622793.pdf
• http://jusativ.biesyiczadyfci.com/uploads/1/3/0/8/130814283/jetifodoziwivurol.pdf
• https://cdn.shopify.com/s/files/1/0431/7193/8461/files/37155448030.pdf
• https://cdn.shopify.com/s/files/1/0458/0048/9126/files/designer_drafting_and_visualizing_for_the_entertainment_world.pdf
• https://cdn.shopify.com/s/files/1/0439/0528/6296/files/graphic_design_retainer_contract_template.pdf
• https://f669989f-5947-496e-8b1c-938ebf4a2fe1.filesusr.com/ugd/a58502_833a46d2d2b74a12bd08b919a3c84789.pdf?index=true
• https://e92ac8b8-a1f4-4e61-a1f8-389c1cc00a11.filesusr.com/ugd/c450b2_434b95b2c4bd477aa3a4d7a1d4449bca.pdf?index=true
• https://8d2963e9-1f03-4fba-adb1-c434a32a6fd7.filesusr.com/ugd/b0b521_13db4717ca2841d4b81bda1342f5004c.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• a88b81a3-b7b3-4a08-85d0-9f243825dde5.filesusr.com
• f9e93eb7-f703-4f5b-90b9-5a452d306726.filesusr.com
• cef96d5e-0c67-4edd-975a-5d19c8da32d2.filesusr.com
• 3d5b0252-70c3-4101-8ee6-f43234f73917.filesusr.com
• adaca82c-bcdf-4b7d-9ad3-1794181a402f.filesusr.com
• files.enlaorillathefilm.com
• jusativ.biesyiczadyfci.com
• cdn.shopify.com
• f669989f-5947-496e-8b1c-938ebf4a2fe1.filesusr.com
• e92ac8b8-a1f4-4e61-a1f8-389c1cc00a11.filesusr.com
• 8d2963e9-1f03-4fba-adb1-c434a32a6fd7.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report