MALICIOUS — e50c99_429efe9b232047018d6eb52f328e8580.pdf

MALICIOUS — e50c99_429efe9b232047018d6eb52f328e8580.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 627a642f1c6d1a30cc258438a2e90fa33bdbb81b5b59a10d93dc7424e39f85ac
• SHA-1: 2d4479b00aad793367d3152fcdf8eed1549340cf
• MD5: 0f0e6bbe8fae5ea42ded3332fa50b910
• ssdeep: 768:egGzpDf1JXkL2XKLY8pDMLG3Pj+W2Qw+wb8OoFCMiU:bGFD1i+W+bXoFCMiU
• TLSH: T114308DF35097DCCC2B8EAF53AEEA1159604AE68D6122D6A04488376CC57C7ED7F10861
• Submitted as: e50c99_429efe9b232047018d6eb52f328e8580.pdf
• File type: pdf · Size: 36705 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=geometry+dash+apk+here, https://cdn.shopify.com/s/files/1/0434/4417/5013/files/interior_angles_in_polygons_worksheet_tes.pdf, https://cdn.shopify.com/s/files/1/0428/4301/3287/files/88932647171.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=geometry+dash+apk+here
• https://cdn.shopify.com/s/files/1/0434/4417/5013/files/interior_angles_in_polygons_worksheet_tes.pdf
• https://cdn.shopify.com/s/files/1/0428/4301/3287/files/88932647171.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/gejazopemovaro.pdf
• https://cdn.shopify.com/s/files/1/0429/1470/9670/files/38575302406.pdf
• https://cdn.shopify.com/s/files/1/0437/8850/1143/files/percentage_calculator_software_free.pdf
• http://files.narwc.org/uploads/1/3/0/9/130969118/2af283bc70.pdf
• http://files.keriduncan.com/uploads/1/3/1/8/131856991/6198827.pdf
• http://tekaxek.lanternlighttheatrecompany.com/uploads/1/3/1/3/131398140/7829894.pdf
• https://cdn.shopify.com/s/files/1/0429/7916/4314/files/morisky_medication_adherence_scale_8_item.pdf
• https://cdn.shopify.com/s/files/1/0433/7077/4679/files/english_grammar_basic_test.pdf
• https://cdn.shopify.com/s/files/1/0430/9480/2583/files/mumusezuk.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/49726552648.pdf
• https://55eed06b-889a-46d6-a1a2-134f79671a68.filesusr.com/ugd/2f7489_45b0693479b9490dbcee7e2985b0444d.pdf?index=true
• https://21393ad2-41f8-4d97-8df1-60ea38241e5f.filesusr.com/ugd/18122d_3c50b58ac8f44cedbda6602993cbb8eb.pdf?index=true
• https://2ad73e95-f391-4c80-b54b-f473df8a4650.filesusr.com/ugd/3ed902_a96f8e4f81f94e0a878dbb298c4eee71.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• cdn.shopify.com
• files.narwc.org
• files.keriduncan.com
• tekaxek.lanternlighttheatrecompany.com
• 55eed06b-889a-46d6-a1a2-134f79671a68.filesusr.com
• 21393ad2-41f8-4d97-8df1-60ea38241e5f.filesusr.com
• 2ad73e95-f391-4c80-b54b-f473df8a4650.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report