MALICIOUS — 73c254_d641775ac5e14c2885b16e28714f080f.pdf

MALICIOUS — 73c254_d641775ac5e14c2885b16e28714f080f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: 6e5cd11b3fc9dd362086ead8fa04c4ef3863cc500e2bbca9cab6f0876a6e4a43
• SHA-1: 619246909683db13b02741266bf9f3fd23c28059
• MD5: fc955a2ec10c21025a9d1644d798cf9d
• ssdeep: 768:LgGzpDxFpYLnXCCYJZYD1lc9ope+cmOD2pWn8Hno7XUSc2rviuctv:0GFXiXiJZr4Wn8H4X6Uiuctv
• TLSH: T191319EF7506BEC8CBD86DF03AEA724599149D6895172963049C8373CC4BC2BC7F50A61
• Submitted as: 73c254_d641775ac5e14c2885b16e28714f080f.pdf
• File type: pdf · Size: 42073 bytes
• Verdict: malicious (94/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish!atmn
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 94/100 is the fusion of 7 weighted signals:

• Microsoft Defender flagged Trojan:PDF/Phish!atmn (rule Trojan:PDF/Phish!atmn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=hb+overpayment+recovery+guide, http://tawarudi.c1comics.com/uploads/1/3/1/0/131071157/bekeka.pdf, http://pogolefot.clearmomentsupplies.com/uploads/1/3/0/9/130969754/4352185.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=hb+overpayment+recovery+guide
• http://tawarudi.c1comics.com/uploads/1/3/1/0/131071157/bekeka.pdf
• http://pogolefot.clearmomentsupplies.com/uploads/1/3/0/9/130969754/4352185.pdf
• http://files.roseworksconsulting.com/uploads/1/3/2/7/132740594/2303405.pdf
• http://kavoz.laurahawbaker.com/uploads/1/3/1/8/131857120/14c5f0e7bb55.pdf
• https://98bec581-5109-4769-9dc3-3468ca30ac03.filesusr.com/ugd/60e703_a386e94fb9cd4d1b9374cf1167e473fc.pdf?index=true
• https://146405b1-7178-4ed3-92af-bcde5c8f91e1.filesusr.com/ugd/2e16aa_05a05eb2a61541dd8922aadc2ebd9935.pdf?index=true
• https://313da5ab-984f-4428-8267-00ed2feea125.filesusr.com/ugd/43d2fc_ffccde070c9d4fe1ae86e799c8dfa370.pdf?index=true
• https://ba8997c3-f414-4b0b-9d5d-587d00ad2287.filesusr.com/ugd/b926a8_19687598bfa540b099c57fea315cfe19.pdf?index=true
• https://dea66520-d3a5-430b-b892-122f19b9e3ae.filesusr.com/ugd/384ea4_472a3b0799af4708b7b1afcdf1937112.pdf?index=true
• https://cdn.shopify.com/s/files/1/0432/9039/4788/files/plaut_aulularia.pdf
• https://cdn.shopify.com/s/files/1/0434/0498/4474/files/91081915602.pdf
• https://cdn.shopify.com/s/files/1/0432/7358/4793/files/abnormal_uterine_bleeding_rcog_guidelines.pdf
• https://cdn.shopify.com/s/files/1/0431/9471/2228/files/pogelu.pdf
• https://cdn.shopify.com/s/files/1/0463/3447/6449/files/26465804666.pdf
• https://cdn.shopify.com/s/files/1/0432/7378/1408/files/10802161121.pdf
• https://cdn.shopify.com/s/files/1/0430/6301/7629/files/getefovijenajoxunejew.pdf
• https://cdn.shopify.com/s/files/1/0437/9390/7869/files/ableton_live_9._7._5_mac.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• tawarudi.c1comics.com
• pogolefot.clearmomentsupplies.com
• files.roseworksconsulting.com
• kavoz.laurahawbaker.com
• 98bec581-5109-4769-9dc3-3468ca30ac03.filesusr.com
• 146405b1-7178-4ed3-92af-bcde5c8f91e1.filesusr.com
• 313da5ab-984f-4428-8267-00ed2feea125.filesusr.com
• ba8997c3-f414-4b0b-9d5d-587d00ad2287.filesusr.com
• dea66520-d3a5-430b-b892-122f19b9e3ae.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report