MALICIOUS — 43d598_f39d28126a514585bdbbc3744214e4ab.pdf

MALICIOUS — 43d598_f39d28126a514585bdbbc3744214e4ab.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 64d09e1195a6f620530ec9e690512b0653fcc4684424dc2409b2b8078ce8b7b9
• SHA-1: 3bb269b316083736dff14f2634c84a992bb8798a
• MD5: 2eb8e5f912871ef96c686aa5aeb3b742
• ssdeep: 1536:kGF8ewDr0GpDOsMmXYkChw+SE1LWyv690:xF8e2rxDOsMmokCh1117vp
• TLSH: T1CA33BFF301A7EC4CAB8AAF136EF710586492C79D3122969409D8773CD97C2ED5F50A60
• Submitted as: 43d598_f39d28126a514585bdbbc3744214e4ab.pdf
• File type: pdf · Size: 50724 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=types+of+levers, http://putumox.thealpinerovers.com/uploads/1/3/0/7/130738796/b65578.pdf, http://tefegu.ivory-wang.com/uploads/1/3/1/0/131070374/xetesap.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=types+of+levers
• http://putumox.thealpinerovers.com/uploads/1/3/0/7/130738796/b65578.pdf
• http://tefegu.ivory-wang.com/uploads/1/3/1/0/131070374/xetesap.pdf
• http://wozuzid.theantiquegarage.com/uploads/1/3/1/3/131379958/6868649.pdf
• http://rojogenud.racestatecollege.com/uploads/1/3/1/8/131856772/darasuwibadodil.pdf
• http://pinaxapo.johnbgibbonslaw.com/uploads/1/3/1/6/131606233/wogokuzewovepedi.pdf
• https://bab55eb1-1d98-4bd0-bfd5-6396c9e60edb.filesusr.com/ugd/8c5bc8_cc622140f1344721a54ff7fb512c5e13.pdf?index=true
• https://8ab4c8fc-d885-4e02-b3b7-752df802d45f.filesusr.com/ugd/4fb05f_829b6a4dac0e4413bc1bb163a6e8bbb4.pdf?index=true
• https://13bfa6d7-f724-44d4-b207-b7c8035ef9fc.filesusr.com/ugd/3225da_db7c5de134324905a79f790217a9dda1.pdf?index=true
• https://cdn.shopify.com/s/files/1/0436/3295/1446/files/37206716268.pdf
• https://cdn.shopify.com/s/files/1/0432/2374/4674/files/71016103227.pdf
• https://f2000082-9d0d-4d58-9b92-64c04d768dc6.filesusr.com/ugd/bba345_748907ce45c44423a491cf49fffa6150.pdf?index=true
• https://bdde5b30-613f-42ff-a4e4-65184758cca8.filesusr.com/ugd/a31856_5b2d6e71b1a44c88a3d0f15ae6dbaebd.pdf?index=true
• https://eb309b7c-ca59-4987-aac7-133037302226.filesusr.com/ugd/a58b01_56f7046118254d4f8cff67e53e18ade8.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• putumox.thealpinerovers.com
• tefegu.ivory-wang.com
• wozuzid.theantiquegarage.com
• rojogenud.racestatecollege.com
• pinaxapo.johnbgibbonslaw.com
• bab55eb1-1d98-4bd0-bfd5-6396c9e60edb.filesusr.com
• 8ab4c8fc-d885-4e02-b3b7-752df802d45f.filesusr.com
• 13bfa6d7-f724-44d4-b207-b7c8035ef9fc.filesusr.com
• cdn.shopify.com
• f2000082-9d0d-4d58-9b92-64c04d768dc6.filesusr.com
• bdde5b30-613f-42ff-a4e4-65184758cca8.filesusr.com
• eb309b7c-ca59-4987-aac7-133037302226.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report