MALICIOUS — 96502608567.pdf

MALICIOUS — 96502608567.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 500d62210a30cec57ff462f40f65eae9578d8e283d77d33a877ead5b22a0fe8d
• SHA-1: be0ae69ef025986cae4319e3720f45163b34b6d7
• MD5: fe50aaf9bb1ffd2bdb252c381215dde8
• ssdeep: 768:0gGzpDtbRnzzEzAvLmmRMhgcG+dkzOjN2R1jfl3Rzgx:BGFRbcwLmeMhzBdkzKN6bzgx
• TLSH: T1A330AEF35467DC4C2A9AAB076DB714196159D68E30339B70489C37BEC9BC2BC7E108A1
• Submitted as: 96502608567.pdf
• File type: pdf · Size: 38054 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ggtraff.ru/strik?keyword=microwave+peanut+brittle+recipe+paula+deen, https://cdn.shopify.com/s/files/1/0435/6653/0721/files/wow_classic_prot_warrior_leveling_guide.pdf, https://cdn.shopify.com/s/files/1/0433/7745/9363/files/zadatafasatekulubone.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ggtraff.ru/strik?keyword=microwave+peanut+brittle+recipe+paula+deen
• https://cdn.shopify.com/s/files/1/0435/6653/0721/files/wow_classic_prot_warrior_leveling_guide.pdf
• https://cdn.shopify.com/s/files/1/0433/7745/9363/files/zadatafasatekulubone.pdf
• https://cdn.shopify.com/s/files/1/0430/5872/5018/files/icy_tower_download_iphone.pdf
• https://uploads.strikinglycdn.com/files/1e90bf48-6b79-4863-b7e1-8e4204d93606/suguxipega.pdf
• https://uploads.strikinglycdn.com/files/59fbfac9-6e4f-4f1a-88cf-1857311b26cf/82902844478.pdf
• https://uploads.strikinglycdn.com/files/58575a5e-e3bf-4680-a308-95f94652cadc/22543151171.pdf
• https://uploads.strikinglycdn.com/files/c719200f-9f8b-426c-89d2-c89297b379d5/90868596406.pdf
• https://uploads.strikinglycdn.com/files/26cf8c9e-ae0b-4b75-a61b-77f396c01a9a/4683305216.pdf
• https://uploads.strikinglycdn.com/files/7bcbbe6b-2350-4f70-8ab8-1e0613b44772/48204195426.pdf
• https://uploads.strikinglycdn.com/files/fb1d3284-54d5-4bff-a06b-e35c941f5589/jisopubasawulezav.pdf
• http://files.westsideyouthministry.org/uploads/1/3/1/8/131871494/zetamif.pdf
• http://files.bedandbreakfastbergeijk.nl/uploads/1/3/0/8/130874586/jonafonujuwuzatev.pdf
• http://dudin.bossethomas.com/uploads/1/3/0/7/130775470/e20c55.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ggtraff.ru
• cdn.shopify.com
• uploads.strikinglycdn.com
• files.westsideyouthministry.org
• files.bedandbreakfastbergeijk.nl
• dudin.bossethomas.com
• www.w3.org
• purl.org
• ns.adobe.com

File paths

• o:\i6

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report