MALICIOUS — d7d6cd_94b5a57ae946413cb7eab67bc865d2b1.pdf

MALICIOUS — d7d6cd_94b5a57ae946413cb7eab67bc865d2b1.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 4ba840a0c8ee74542eae44667e6a540b67294e61c77eb89a8a402b4ad5168ff3
• SHA-1: cf18f76f402cc426b806b3a566449292750cf13a
• MD5: 9d5266b2fd4a249e9d63b6afbff10c94
• ssdeep: 768:agGzpDn8RVGJSWOjCyIE3aD82qR3NErmgzZRJ8/pY/0en:HGFT8K1EKD8+rTVuS0en
• TLSH: T178319EF36067EC8C7ACA6B13A9A60499648BC2CC3136D7605DD8776CC5BC6BDAE00531
• Submitted as: d7d6cd_94b5a57ae946413cb7eab67bc865d2b1.pdf
• File type: pdf · Size: 41876 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=diffuse+reflection+vs+specular+reflection, http://files.theartswithpassion.com/uploads/1/3/0/9/130969153/niropokoj.pdf, http://files.adelanteyouthmission.org/uploads/1/3/1/4/131438557/jezakotajojixepaxo.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=diffuse+reflection+vs+specular+reflection
• http://files.theartswithpassion.com/uploads/1/3/0/9/130969153/niropokoj.pdf
• http://files.adelanteyouthmission.org/uploads/1/3/1/4/131438557/jezakotajojixepaxo.pdf
• http://files.jhromada.com/uploads/1/3/1/3/131381799/vosiremutotixanesal.pdf
• http://sariviro.reearthconsulting.com/uploads/1/3/1/6/131606875/xaxitibosi.pdf
• https://cdn.shopify.com/s/files/1/0437/5740/4309/files/subtraction_with_regrouping_worksheets_grade_2.pdf
• https://cdn.shopify.com/s/files/1/0431/8124/4573/files/josojeduminafo.pdf
• https://cdn.shopify.com/s/files/1/0432/5326/8642/files/alpsankhyak_scholarship_form_online_mp.pdf
• http://lawiveb.mcneillcustomfurniture.com/uploads/1/3/0/9/130969191/06ea7.pdf
• http://rugetug.vapacvesd.com/uploads/1/3/0/8/130873915/5340285.pdf
• http://files.mikesconstruction.com/uploads/1/3/0/7/130775583/jabevijisaw-buzezusatud-xuvanutob-rizuvazupoze.pdf
• https://cdn.shopify.com/s/files/1/0432/2256/5032/files/nogediguwexutopow.pdf
• https://cdn.shopify.com/s/files/1/0433/9266/3702/files/99363661069.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• files.theartswithpassion.com
• files.adelanteyouthmission.org
• files.jhromada.com
• sariviro.reearthconsulting.com
• cdn.shopify.com
• lawiveb.mcneillcustomfurniture.com
• rugetug.vapacvesd.com
• files.mikesconstruction.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report