MALICIOUS — 5bb01c_21a166cdabe34c6a935699eb405a6cab.pdf

MALICIOUS — 5bb01c_21a166cdabe34c6a935699eb405a6cab.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 64889d10761805c0786bdadb1c1cb56f7ef1fc719d0c4e248b0c5de08a98fa1c
• SHA-1: c8fc82fb2e72fc7ed6dd7809c7875a54807f07fb
• MD5: 0f8e20194a6e32751061923cb4c8c06f
• ssdeep: 768:jgGzpDY3d+Igx+1rTWuN2cBW5bcJoQpFum6IBVtrr4U1WRw3u1ORyP94D2G:cGFstJTFXOud6IBVBWR4uY6iD2G
• TLSH: T11D32AEF3A097DC4C7B8E4F531FA610A96169C28DA132E6E064D87A6CC47C6FC6E40970
• Submitted as: 5bb01c_21a166cdabe34c6a935699eb405a6cab.pdf
• File type: pdf · Size: 46369 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=fidelity+total+farm, https://1f7757ca-f808-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/5ccfc8_84a2f4303a114b63840edb0748c495db.pdf?index=true, https://94aff95d-55d3-446c-b0c6-7efdb45c0e13.filesusr.com/ugd/bf650e_ccd98a6a714244e684ff5b7d9831d710.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=fidelity+total+farm
• https://1f7757ca-f808-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/5ccfc8_84a2f4303a114b63840edb0748c495db.pdf?index=true
• https://94aff95d-55d3-446c-b0c6-7efdb45c0e13.filesusr.com/ugd/bf650e_ccd98a6a714244e684ff5b7d9831d710.pdf?index=true
• https://2532a4da-6839-40ea-a26d-1d5260e193a9.filesusr.com/ugd/eb6612_ca88e87f63ca4f63b6fc341ab4292c54.pdf?index=true
• https://61fe5258-5b6e-48cb-bfa3-8b726b63feef.filesusr.com/ugd/4329d7_8bc8212a0238487bad0734678c706824.pdf?index=true
• https://d84958f8-ad2f-4874-958a-49cafecf37d9.filesusr.com/ugd/3ed902_641188b851dd4d0c996171b424eaf326.pdf?index=true
• http://xokazapu.doggroomingventura.com/uploads/1/3/0/8/130873995/zorebojipizufid.pdf
• https://cdn.shopify.com/s/files/1/0462/5108/1877/files/consumer_report_on_kitchenaid_refrigerators.pdf
• https://cdn.shopify.com/s/files/1/0429/9682/6273/files/long_walk_to_freedom_the_autobiography_of_nelson_mandela.pdf
• https://cdn.shopify.com/s/files/1/0440/7066/6390/files/bescouted_android_app.pdf
• https://cdn.shopify.com/s/files/1/0433/0638/5558/files/sipumulepepenigabajozok.pdf
• https://b9baed5f-0991-4acd-9491-267ab2f23c3e.filesusr.com/ugd/33ab24_012f5ba9a4874c3ab81cfe39b78a2783.pdf?index=true
• https://235fd3b6-c81a-4169-be92-020b64e254af.filesusr.com/ugd/2994dd_93a104e0b6da43428e445225d401fef3.pdf?index=true
• https://94b656d9-a167-43af-9595-ab3e76fd09c6.filesusr.com/ugd/359e64_82a4c7f926be48ac939a59bcff187953.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• 1f7757ca-f808-11ea-a328-fc4dd43d38a6.filesusr.com
• 94aff95d-55d3-446c-b0c6-7efdb45c0e13.filesusr.com
• 2532a4da-6839-40ea-a26d-1d5260e193a9.filesusr.com
• 61fe5258-5b6e-48cb-bfa3-8b726b63feef.filesusr.com
• d84958f8-ad2f-4874-958a-49cafecf37d9.filesusr.com
• xokazapu.doggroomingventura.com
• cdn.shopify.com
• b9baed5f-0991-4acd-9491-267ab2f23c3e.filesusr.com
• 235fd3b6-c81a-4169-be92-020b64e254af.filesusr.com
• 94b656d9-a167-43af-9595-ab3e76fd09c6.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report