MALICIOUS — e49726_c39691efbea047ceb6310e9493503d59.pdf

MALICIOUS — e49726_c39691efbea047ceb6310e9493503d59.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 57f791db5abe5d7f791f009d53de02f434147b5e7e98922d291de013ce847b7d
• SHA-1: 43f66ade64e9672d25dcd0e843d71e071618ac87
• MD5: fdc33389998b0a0bf0b559c820ba97e5
• ssdeep: 768:jgGzpDA12eyF2uTk72OFqNMMCBMsdgMgvmO+gNlk2YFcnrbRnC:cGFkgj8u+rLMCBM9MamOVNlkdMbRnC
• TLSH: T191329DF314ABED8C7ADB5F17AD67151C618AC68D5022A37049983B6DC0BC2FD6F41A20
• Submitted as: e49726_c39691efbea047ceb6310e9493503d59.pdf
• File type: pdf · Size: 43608 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=yugioh+duel+links+gem+hack+2019, http://files.truthministryaz.org/uploads/1/3/2/6/132695354/9901905.pdf, http://menofineb.maltingsstructures.com/uploads/1/3/0/7/130775818/1180863.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=yugioh+duel+links+gem+hack+2019
• http://files.truthministryaz.org/uploads/1/3/2/6/132695354/9901905.pdf
• http://menofineb.maltingsstructures.com/uploads/1/3/0/7/130775818/1180863.pdf
• http://files.kristamasonyogafitness.com/uploads/1/3/1/1/131164023/5788931.pdf
• http://dojaromu.paxcon.org/uploads/1/3/2/6/132682646/ninexemijatimonigeku.pdf
• http://kizumaxuw.hidayatashila.com/uploads/1/3/0/8/130874473/kanevepij_suvitimuzuwimos_wusolavafadel.pdf
• https://f237a74f-4f05-47c0-a1ee-89b32d3de73b.filesusr.com/ugd/c722c2_0d48dd1ece74471b896a0dc1e94688b3.pdf?index=true
• https://129abf06-63b3-41ba-ba61-28caa18a9c4a.filesusr.com/ugd/696117_2af62de447764666bcf7f0da8723d5db.pdf?index=true
• https://94db83d0-3165-45ec-871f-de637b1d37ec.filesusr.com/ugd/b148e5_6356c5192af5460dac7ddce490b49cd1.pdf?index=true
• https://1600ca33-195a-483f-8d68-725bc30f3980.filesusr.com/ugd/3be48b_2f8c495ac0f84a23b9de9d821f5a776e.pdf?index=true
• https://3fcb76e9-2671-4fcb-98ab-b6f9d78d52a4.filesusr.com/ugd/0af078_dcbb2e3425524604b3f9872f6035e212.pdf?index=true
• https://a890ad2e-9b24-402e-8235-0daeea7fec0f.filesusr.com/ugd/696117_1ed0770042ec42849505141ebac7bbfb.pdf?index=true
• https://6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com/ugd/35c6e2_2059b52814764830a4fa6d03ab5a600d.pdf?index=true
• https://2c3ace21-ece0-4f8b-9232-fd35f69f4fce.filesusr.com/ugd/e643da_3afdd5fe245c4560a315c3339502db79.pdf?index=true
• https://26029428-028f-496b-9036-92eacd7e9088.filesusr.com/ugd/ac8c68_47179dae32ce44619dac885bc6b4468a.pdf?index=true
• https://bbb6adaa-e996-4a76-91fe-dac8fba7fc9c.filesusr.com/ugd/e948c1_6cfdd88809a247d398c6a9fd98660ab8.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• files.truthministryaz.org
• menofineb.maltingsstructures.com
• files.kristamasonyogafitness.com
• dojaromu.paxcon.org
• kizumaxuw.hidayatashila.com
• f237a74f-4f05-47c0-a1ee-89b32d3de73b.filesusr.com
• 129abf06-63b3-41ba-ba61-28caa18a9c4a.filesusr.com
• 94db83d0-3165-45ec-871f-de637b1d37ec.filesusr.com
• 1600ca33-195a-483f-8d68-725bc30f3980.filesusr.com
• 3fcb76e9-2671-4fcb-98ab-b6f9d78d52a4.filesusr.com
• a890ad2e-9b24-402e-8235-0daeea7fec0f.filesusr.com
• 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com
• 2c3ace21-ece0-4f8b-9232-fd35f69f4fce.filesusr.com
• 26029428-028f-496b-9036-92eacd7e9088.filesusr.com
• bbb6adaa-e996-4a76-91fe-dac8fba7fc9c.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report