MALICIOUS — 87a178_9a254070fe94454b91df32aa3e9d4ffc.pdf

MALICIOUS — 87a178_9a254070fe94454b91df32aa3e9d4ffc.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 5eff325a503fb0e5a1f5c27fbb92629f6002fcfb0e4ab70c4986babc3f6d3793
• SHA-1: 35de5d6117521b602c4ec58bb867973155b802a8
• MD5: 57e26a1e264c1f38fab1db28f3a2786d
• ssdeep: 1536:fGFgd2dYk9iQzDwFgKZT0wNLikgpgD7XJ3:OFgCTsFgKuwRVgp+7Z3
• TLSH: T1DA33BFF344ABFD8C6C85AF17A8EA0509208ACA4C7176937408DD7B6CC4BC6BD6E55630
• Submitted as: 87a178_9a254070fe94454b91df32aa3e9d4ffc.pdf
• File type: pdf · Size: 51450 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=great+writing+1+4th+edition+pdf+free+download, http://files.plantmorenatives.com/uploads/1/3/0/7/130775200/gusolupelodoj.pdf, http://files.bluemooncustombuilders.com/uploads/1/3/1/3/131398406/7183974.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=great+writing+1+4th+edition+pdf+free+download
• http://files.plantmorenatives.com/uploads/1/3/0/7/130775200/gusolupelodoj.pdf
• http://files.bluemooncustombuilders.com/uploads/1/3/1/3/131398406/7183974.pdf
• http://files.brainylife.org/uploads/1/3/1/3/131383753/rufawubufeb.pdf
• http://renite.carpetcleaninghuntsville.com/uploads/1/3/1/4/131452842/xutewibe.pdf
• https://3c83904e-baad-4e57-87bc-3c5a63082a14.filesusr.com/ugd/9ea91e_35ea84ea58154cca8d2247cef2467b9b.pdf?index=true
• https://537deb8d-1715-4b5f-84b1-451b89318887.filesusr.com/ugd/80bfa9_28538a621f8547d48c1443d8f46e126b.pdf?index=true
• https://e6852681-412f-4ffd-8000-fa5aa280faf6.filesusr.com/ugd/a37a2e_ef8c5f44750d4abe89425b03c98a4b64.pdf?index=true
• https://ec7f8c5b-e812-45f9-9c04-bd55932d52ff.filesusr.com/ugd/8aba0c_df828c41524948689332cbdb82381eb8.pdf?index=true
• https://e0430fcd-33a4-4490-9e82-a412e1bb08db.filesusr.com/ugd/e3c460_25495d0557d04aab9b2001fd45989bc5.pdf?index=true
• http://files.iancurtisarchitecture.com/uploads/1/3/1/4/131437074/e7932.pdf
• http://files.exceltronics.co.uk/uploads/1/3/1/4/131453969/mavomawisukajov.pdf
• https://3c06c5f5-14c4-4ebf-9327-5e38ec17d169.filesusr.com/ugd/269bb8_5142a79352c943a2bf208fc99b957d95.pdf?index=true
• https://320497c6-5327-4e58-b18c-31287c159d8f.filesusr.com/ugd/610d21_67624ee0efe74a64818bff6f2b4d6637.pdf?index=true
• https://ddeb9bc1-8b91-4a10-86af-54961db76620.filesusr.com/ugd/003b86_a1ab1170a5864a46977b4a57badeeb44.pdf?index=true
• https://63e8150d-3311-448a-8240-ddef9ea45ce8.filesusr.com/ugd/c068f8_320e2c2ec9344358936691c98a76fef0.pdf?index=true
• https://b10d9f71-635b-424d-95b6-a82c8fa03498.filesusr.com/ugd/529dbf_dca699f3c456400eb1ec04ce0d9a9eb6.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• files.plantmorenatives.com
• files.bluemooncustombuilders.com
• files.brainylife.org
• renite.carpetcleaninghuntsville.com
• 3c83904e-baad-4e57-87bc-3c5a63082a14.filesusr.com
• 537deb8d-1715-4b5f-84b1-451b89318887.filesusr.com
• e6852681-412f-4ffd-8000-fa5aa280faf6.filesusr.com
• ec7f8c5b-e812-45f9-9c04-bd55932d52ff.filesusr.com
• e0430fcd-33a4-4490-9e82-a412e1bb08db.filesusr.com
• files.iancurtisarchitecture.com
• files.exceltronics.co.uk
• 3c06c5f5-14c4-4ebf-9327-5e38ec17d169.filesusr.com
• 320497c6-5327-4e58-b18c-31287c159d8f.filesusr.com
• ddeb9bc1-8b91-4a10-86af-54961db76620.filesusr.com
• 63e8150d-3311-448a-8240-ddef9ea45ce8.filesusr.com
• b10d9f71-635b-424d-95b6-a82c8fa03498.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report