MALICIOUS — 8a9bcc_93b68a5e298b48d0acde1f3b44b849dd.pdf

MALICIOUS — 8a9bcc_93b68a5e298b48d0acde1f3b44b849dd.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 630c9386b7bb7eaacf2ac813ea01e13d022064cc9ec2c3b3010e8a427a2c2f75
• SHA-1: db845103768f130560a711e735f0b658a2601d31
• MD5: a67324f0b71acff9e83c465231a400f4
• ssdeep: 768:ngGzpDL8i6SYJkEsD9lzsFH3EYJD+8L2Z6dWvShFHv38lDV7p90GVfP1:gGFfdRYJDNhdqShFHvMdV7X0GVfP1
• TLSH: T13332ADF364ABEC8C7A8B9B63ADE71515614AC38C22269350598C3B6CD47C6FC6F10921
• Submitted as: 8a9bcc_93b68a5e298b48d0acde1f3b44b849dd.pdf
• File type: pdf · Size: 46443 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=secondary+math+module+4+answer+key, http://wivupi.barbarayontzatstac.com/uploads/1/3/0/8/130814124/aa46e80b.pdf, http://sazena.sewickleyhuntclub.com/uploads/1/3/0/7/130775519/a71049da.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=secondary+math+module+4+answer+key
• http://wivupi.barbarayontzatstac.com/uploads/1/3/0/8/130814124/aa46e80b.pdf
• http://sazena.sewickleyhuntclub.com/uploads/1/3/0/7/130775519/a71049da.pdf
• http://files.codhead.co.uk/uploads/1/3/1/4/131483361/96570f3beb2.pdf
• http://files.mandakemp.com/uploads/1/3/1/3/131384777/8881296.pdf
• http://files.future-fis.com/uploads/1/3/1/4/131406544/merodalukuze.pdf
• https://cdn.shopify.com/s/files/1/0463/6173/9419/files/78113464229.pdf
• https://cdn.shopify.com/s/files/1/0430/9568/7328/files/alejandro_jodorowsky_psicomagia.pdf
• https://cdn.shopify.com/s/files/1/0440/5349/5958/files/a_remarkable_beetle_reading_answers_mini_ielts.pdf
• https://cdn.shopify.com/s/files/1/0428/0641/1431/files/kewaludulitepagetuxorin.pdf
• https://cdn.shopify.com/s/files/1/0435/1285/6731/files/blue_light_background_images.pdf
• http://remivan.nazbahtom.com/uploads/1/3/1/4/131408738/8e6984932e522f.pdf
• http://bofipov.nayaung.net/uploads/1/3/0/7/130775755/lazedowagajegipa.pdf
• http://lilexir.bethelbentonville.org/uploads/1/3/1/6/131636648/2962e6ab8.pdf
• http://dafegeba.criminalbaking.com/uploads/1/3/1/3/131382406/limef.pdf
• https://cdn.shopify.com/s/files/1/0437/7188/7767/files/24318575996.pdf
• https://cdn.shopify.com/s/files/1/0435/1324/9944/files/gibumefunuzajoxalid.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• wivupi.barbarayontzatstac.com
• sazena.sewickleyhuntclub.com
• files.codhead.co.uk
• files.mandakemp.com
• files.future-fis.com
• cdn.shopify.com
• remivan.nazbahtom.com
• bofipov.nayaung.net
• lilexir.bethelbentonville.org
• dafegeba.criminalbaking.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report