MALICIOUS — 70e7d4_2b1d6884e0a94bfcb82fb0c833916254.pdf

MALICIOUS — 70e7d4_2b1d6884e0a94bfcb82fb0c833916254.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 55edcfd406fa9dec29ef94d7b32a3bc807b480f3496e54b7184d86473423c2e5
SHA-1: d29e0c77a1cd1be58be678e47552fc6213f2ab9d
MD5: 140da582acf0144c68b5973f5ef6ecd3
ssdeep: 1536:5GFFMhAyk6NVHy05iX7mpa7NoWkPgQ0y6I:MFFnyDHN5iLmp4NoWkPD9
TLSH: T12C349DF350A7ECCC76CAAF03AEB70159605BC38CA13296A415C9776CD4BC2AE6E10564
Submitted as: 70e7d4_2b1d6884e0a94bfcb82fb0c833916254.pdf
File type: pdf · Size: 52454 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.club/wix?keyword=community+minded+pathfinder, http://tebozilur.spiritusnw.org/uploads/1/3/0/7/130775288/gekatupasisazo.pdf, http://febumag.arkumc.org/uploads/1/3/0/8/130813668/a3dcdce39890.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.club/wix?keyword=community+minded+pathfinder
http://tebozilur.spiritusnw.org/uploads/1/3/0/7/130775288/gekatupasisazo.pdf
http://febumag.arkumc.org/uploads/1/3/0/8/130813668/a3dcdce39890.pdf
http://files.finaticsportfishing.com/uploads/1/3/2/6/132695694/77d36c74ab30baa.pdf
http://files.toastygoat.com/uploads/1/3/1/4/131452811/kumawiguzomojasow.pdf
http://peril.joewilford.com/uploads/1/3/1/6/131637503/3520257.pdf
http://pivovu.gordonstounartandphotography.com/uploads/1/3/0/7/130738948/mowazeworat.pdf
http://gikakop.mustardseeds.co/uploads/1/3/2/7/132740324/4205347.pdf
http://dipavepa.hannahtylerdesigns.com/uploads/1/3/2/7/132740837/569142.pdf
http://files.projectq.co.uk/uploads/1/3/0/7/130776162/75d9fdc0531.pdf
http://xivazorup.defendingthechristianfaith.org/uploads/1/3/0/7/130738625/b131aa371866f9.pdf
http://witan.mobilhicksville.com/uploads/1/3/2/7/132712109/abb19.pdf
http://files.icttg.com/uploads/1/3/0/7/130739183/9915664.pdf
http://files.intosai-faas.org/uploads/1/3/2/8/132815054/6182155.pdf
https://cdn.shopify.com/s/files/1/0431/3972/7509/files/daxavefuxizesiwutinewojul.pdf
https://cdn.shopify.com/s/files/1/0434/3640/8982/files/goviwuluvefilosule.pdf
https://cdn.shopify.com/s/files/1/0439/1016/8744/files/clarinet_sheet_music.pdf
https://cdn.shopify.com/s/files/1/0431/5676/6882/files/buzigilefegunusedilexam.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.club
tebozilur.spiritusnw.org
febumag.arkumc.org
files.finaticsportfishing.com
files.toastygoat.com
peril.joewilford.com
pivovu.gordonstounartandphotography.com
gikakop.mustardseeds.co
dipavepa.hannahtylerdesigns.com
files.projectq.co.uk
xivazorup.defendingthechristianfaith.org
witan.mobilhicksville.com
files.icttg.com
files.intosai-faas.org
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report