MALICIOUS — d55797_942f324e2e5f46adb5be219def01bdd9.pdf

MALICIOUS — d55797_942f324e2e5f46adb5be219def01bdd9.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 54f7940da56044e2758effea44591336438239198da717d04deb6a11f7c1c741
• SHA-1: adf3c1f66654ecaa5039832ce299cd884910a89b
• MD5: 28f1c7098f8ef3a5d3d58a038a9fb9bc
• ssdeep: 768:WgGzpDFeBdULWlfPd46JQsLpWjxj4j2maTJasj3+6eE:DGFRGHPd46JQsLsjmaTJasj3+6eE
• TLSH: T12731AFF354E7EC8C7A8A9B03ADAA02996049D3896137976015DC776CC4BC6FCAF40D60
• Submitted as: d55797_942f324e2e5f46adb5be219def01bdd9.pdf
• File type: pdf · Size: 40979 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=alwyn+home+adjustable+bed+frame, http://majijep.fairplaylabradors.com/uploads/1/3/1/4/131453698/remir-mozek.pdf, http://rizula.roberttatemiller.com/uploads/1/3/1/4/131453850/d16e304740ff.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=alwyn+home+adjustable+bed+frame
• http://majijep.fairplaylabradors.com/uploads/1/3/1/4/131453698/remir-mozek.pdf
• http://rizula.roberttatemiller.com/uploads/1/3/1/4/131453850/d16e304740ff.pdf
• http://vegilikek.earthcaredesign.co.uk/uploads/1/3/0/7/130739625/0dcc75ee.pdf
• http://files.reedertranslationservices.com/uploads/1/3/1/6/131606733/moxutuvevukoli.pdf
• https://a5a03804-9f9c-41f1-95ee-9e2c4a7d255a.filesusr.com/ugd/5dc3ca_77371e9b907441509c4fc049d4cc8858.pdf?index=true
• https://99552406-4c3f-470e-a770-ec8cb9b4c007.filesusr.com/ugd/5bf82b_6da8961dd17b462db61cace956d08645.pdf?index=true
• https://54b6e866-33b5-4fff-b700-68334175a47d.filesusr.com/ugd/9904c2_1890c9d1d483431e9940b1aa858b6637.pdf?index=true
• https://ee959c54-99b6-4890-b290-872cc324a9df.filesusr.com/ugd/035627_be729db9189f4acfa98136be801f1ecd.pdf?index=true
• https://e44c3155-bca1-4daa-ab8a-460573827c12.filesusr.com/ugd/58a813_970dad472a4e47d593e0db25c6010caa.pdf?index=true
• https://c428a34e-4ad3-4ac7-bbe7-1c5d2ff6d122.filesusr.com/ugd/8a419d_63a4c93c38ee448993af5f441f42e9ee.pdf?index=true
• https://51bddec3-22d8-4fa6-9aed-8c02240b040c.filesusr.com/ugd/a382ee_c41b8a6d14ca41128a5f1d0cae42e215.pdf?index=true
• https://10399acd-6eb8-4adb-94e2-6897f5954eed.filesusr.com/ugd/0adedf_f0cb13035bd64f31a2dec707f2543ee0.pdf?index=true
• https://212965dc-1769-49f4-bc78-45dbdd93ae7f.filesusr.com/ugd/b81754_b1769ca90a624fb2a44f73e7e40a25d7.pdf?index=true
• https://73691874-1dfa-4ac9-8967-349d7f388f77.filesusr.com/ugd/54b9a1_cf05a90360a446cf8ef66479f8bb4527.pdf?index=true
• https://f6c15a2d-8280-45be-8b0c-8ceb47434da2.filesusr.com/ugd/6924eb_8a383d7504bb47cdac22955aada03979.pdf?index=true
• https://b6663766-9b7f-4fb1-9f38-8c3dcbb90bbb.filesusr.com/ugd/3fd21f_218879bd8eeb4c5e9158a7491ef400b8.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• majijep.fairplaylabradors.com
• rizula.roberttatemiller.com
• vegilikek.earthcaredesign.co.uk
• files.reedertranslationservices.com
• a5a03804-9f9c-41f1-95ee-9e2c4a7d255a.filesusr.com
• 99552406-4c3f-470e-a770-ec8cb9b4c007.filesusr.com
• 54b6e866-33b5-4fff-b700-68334175a47d.filesusr.com
• ee959c54-99b6-4890-b290-872cc324a9df.filesusr.com
• e44c3155-bca1-4daa-ab8a-460573827c12.filesusr.com
• c428a34e-4ad3-4ac7-bbe7-1c5d2ff6d122.filesusr.com
• 51bddec3-22d8-4fa6-9aed-8c02240b040c.filesusr.com
• 10399acd-6eb8-4adb-94e2-6897f5954eed.filesusr.com
• 212965dc-1769-49f4-bc78-45dbdd93ae7f.filesusr.com
• 73691874-1dfa-4ac9-8967-349d7f388f77.filesusr.com
• f6c15a2d-8280-45be-8b0c-8ceb47434da2.filesusr.com
• b6663766-9b7f-4fb1-9f38-8c3dcbb90bbb.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report