MALICIOUS — 76e31d_2a33f3e636fe491d93439309b5b3c5b0.pdf

MALICIOUS — 76e31d_2a33f3e636fe491d93439309b5b3c5b0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 4d4fa33af2e197da9bbb27f3fbe978adcbe26902217a9d0a8a6fc81aa60e157e
• SHA-1: 2b0e7aaef0496f9276f776791aee1e04e053a86a
• MD5: 4b0aba73378ac1e48c0f71aac7349d88
• ssdeep: 768:QgGzpDibEpvE/WrCsFXbVPsDgzW3BWpCfb44UPo40gBE:9GF2IE/WrFFBPsDgAWpCJWo40gBE
• TLSH: T1F1319EF750B7EC8C768A9F576B960088705AC7892132673415DD7A7C88BC2FD9F11A10
• Submitted as: 76e31d_2a33f3e636fe491d93439309b5b3c5b0.pdf
• File type: pdf · Size: 39442 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=arctic+cat+atv+service+manual+free+download, http://kexowo.carolinejunkins.com/uploads/1/3/0/7/130739922/b8a6cc9.pdf, http://womum.artbyelinor.com/uploads/1/3/1/3/131398008/rajilurilololabe.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=arctic+cat+atv+service+manual+free+download
• http://kexowo.carolinejunkins.com/uploads/1/3/0/7/130739922/b8a6cc9.pdf
• http://womum.artbyelinor.com/uploads/1/3/1/3/131398008/rajilurilololabe.pdf
• http://sejemi.snowyrangeleather.com/uploads/1/3/1/1/131164066/gexexabigekatoxaso.pdf
• https://d45e78ac-4559-4c55-84e7-9754fcca3399.filesusr.com/ugd/6e13d9_9b2a72566a9c49249c51bf97448bd914.pdf?index=true
• http://sunexe.jasperlegion.ca/uploads/1/3/1/4/131407876/1faf3bf41bc04.pdf
• http://files.healthstyled.com/uploads/1/3/2/6/132695663/gusoj.pdf
• https://c5c0c8cf-52fb-46e8-bf80-6d180725315b.filesusr.com/ugd/f68081_2d385c43b30a4ed89a15f8981d2c7ced.pdf?index=true
• https://90a7d240-6d70-4a1b-9621-6eafbfe3733b.filesusr.com/ugd/ed8107_4f0a819e53cd4be7a42616e6919a3df2.pdf?index=true
• https://55877602-bc44-484f-b78f-07d45f338d9a.filesusr.com/ugd/957c7b_8ee84fdabf0540fc93997a457b83fa6f.pdf?index=true
• https://8809969c-2c79-4e61-b552-74cf05d90804.filesusr.com/ugd/158fb9_8475477a780f41adad1c6027c10a61b8.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• kexowo.carolinejunkins.com
• womum.artbyelinor.com
• sejemi.snowyrangeleather.com
• d45e78ac-4559-4c55-84e7-9754fcca3399.filesusr.com
• sunexe.jasperlegion.ca
• files.healthstyled.com
• c5c0c8cf-52fb-46e8-bf80-6d180725315b.filesusr.com
• 90a7d240-6d70-4a1b-9621-6eafbfe3733b.filesusr.com
• 55877602-bc44-484f-b78f-07d45f338d9a.filesusr.com
• 8809969c-2c79-4e61-b552-74cf05d90804.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report