MALICIOUS — 4a2613_f498878873a140088c8384ca9a4cb23f.pdf

MALICIOUS — 4a2613_f498878873a140088c8384ca9a4cb23f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 6b973e6e4ce8db7fb664c3ef2e06085222b7ae014308baab1261f82b33cd14f3
• SHA-1: d7935c388d25fe1bb837d515b9888b2e9ea37b06
• MD5: 971cd9ceee21a1e59376a85b7fc93827
• ssdeep: 1536:IGFTzb92gYqR1HeCniJwlpn1lWU23z/ZM:lFTz5HL9mwLnXx2DO
• TLSH: T16B36C0F3519BDC887A866B4369E710547096CBCA6137AB6408DCBF6CC87C7ACBE40950
• Submitted as: 4a2613_f498878873a140088c8384ca9a4cb23f.pdf
• File type: pdf · Size: 66778 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=pathfinder+ice+elemental+small, https://05f9ae52-1bdd-4262-aadb-dc09713fefb2.filesusr.com/ugd/8ce377_f3ac5f7f5d7d4314bccdbb164df75c51.pdf?index=true, https://bb3b5b9f-3461-451f-aee4-1bff73bcb2c6.filesusr.com/ugd/5f5755_16e26bbee8974794963b338554327192.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=pathfinder+ice+elemental+small
• https://05f9ae52-1bdd-4262-aadb-dc09713fefb2.filesusr.com/ugd/8ce377_f3ac5f7f5d7d4314bccdbb164df75c51.pdf?index=true
• https://bb3b5b9f-3461-451f-aee4-1bff73bcb2c6.filesusr.com/ugd/5f5755_16e26bbee8974794963b338554327192.pdf?index=true
• https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true
• http://nuxareve.studiothinking.org/uploads/1/3/1/6/131637814/6950045.pdf
• https://de00ddf8-18cf-4e77-aa3e-0584e3bba0fd.filesusr.com/ugd/69695d_b7d9732612ac4db6a0636858463a1b81.pdf?index=true
• https://b92ab704-1361-412e-90c2-8c4a52b3ce00.filesusr.com/ugd/9bd82e_545bdead0463485aa414c0a56d2f7be2.pdf?index=true
• https://8f7783f7-6b6e-4357-a651-02be253558e2.filesusr.com/ugd/911c12_2e255404c81a40b1b75068cde588b2eb.pdf?index=true
• https://61b6f06b-2974-494e-ba1c-755b2329f855.filesusr.com/ugd/24deb6_a6f4c09f4d6c4ff4bcf4b3147b155b88.pdf?index=true
• https://b5946bcc-f728-4cd0-8bb7-bb7f2f27a05a.filesusr.com/ugd/f1780b_e719dad299784e44bb3d7729d28d4753.pdf?index=true
• https://aaae3763-2217-4799-926d-2464c670e026.filesusr.com/ugd/36d413_fa883490fb1647978c6fcf992363a12a.pdf?index=true
• https://cb69f350-c9ea-4153-86bd-68e4569a7af4.filesusr.com/ugd/8a4248_25bcb1ae5a4a4924aaa809e5a5b2c310.pdf?index=true
• https://2a0a04d1-364b-4c19-9a2a-b13c13773aec.filesusr.com/ugd/26481d_0589e5ecf8514ae1a85d8ac2956fd207.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 05f9ae52-1bdd-4262-aadb-dc09713fefb2.filesusr.com
• bb3b5b9f-3461-451f-aee4-1bff73bcb2c6.filesusr.com
• 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
• nuxareve.studiothinking.org
• de00ddf8-18cf-4e77-aa3e-0584e3bba0fd.filesusr.com
• b92ab704-1361-412e-90c2-8c4a52b3ce00.filesusr.com
• 8f7783f7-6b6e-4357-a651-02be253558e2.filesusr.com
• 61b6f06b-2974-494e-ba1c-755b2329f855.filesusr.com
• b5946bcc-f728-4cd0-8bb7-bb7f2f27a05a.filesusr.com
• aaae3763-2217-4799-926d-2464c670e026.filesusr.com
• cb69f350-c9ea-4153-86bd-68e4569a7af4.filesusr.com
• 2a0a04d1-364b-4c19-9a2a-b13c13773aec.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report