MALICIOUS — 38eac1_989b943c5e644eae91f178fe895714f0.pdf

MALICIOUS — 38eac1_989b943c5e644eae91f178fe895714f0.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 7091165541fccb0605ade07cee240d7afd25804003d8e882a5d4c565bafe825b
• SHA-1: d5f2cd247d75199d11eee6decd7a58cfd33c4f44
• MD5: 6d68692ea90e79ee596319cf8754eabf
• ssdeep: 1536:PGFBKhbVQpVtKIE68vTPbmWQTGHW627qdy:+FBKhbVQYIEZvTKfGZ273
• TLSH: T1DF33AEF36097DC8D3B869B13ACA724695486D74CA2339B6009D87B7CC4BC7BDAE01911
• Submitted as: 38eac1_989b943c5e644eae91f178fe895714f0.pdf
• File type: pdf · Size: 51491 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=bleach+brave+souls+mod+apk+unlimited+spirit+orbs+2020, http://files.rachelwoodwardhansen.com/uploads/1/3/0/7/130775387/69673e63.pdf, http://wexopak.notsuchsecretlife.com/uploads/1/3/1/4/131453574/4490120.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=bleach+brave+souls+mod+apk+unlimited+spirit+orbs+2020
• http://files.rachelwoodwardhansen.com/uploads/1/3/0/7/130775387/69673e63.pdf
• http://wexopak.notsuchsecretlife.com/uploads/1/3/1/4/131453574/4490120.pdf
• http://files.isoandbusinessexpert.com/uploads/1/3/0/8/130813797/noxodak.pdf
• http://files.strangelight.org/uploads/1/3/2/8/132814241/9699942.pdf
• http://files.bookworldtravel.com/uploads/1/3/1/3/131379894/teturegifusi.pdf
• http://rixuzane.mrmobileomaha.com/uploads/1/3/2/6/132680813/xukopimetajulo.pdf
• http://files.knockouthumor.com/uploads/1/3/1/0/131070246/71c8d42.pdf
• http://vutadedas.chinookwritingandjournaling.com/uploads/1/3/1/4/131437889/nebunafuboxevatada.pdf
• http://files.glassbynanc.com/uploads/1/3/1/1/131163969/bubigowedim.pdf
• http://files.legacy-creek.com/uploads/1/3/1/0/131070500/2060828.pdf
• http://dinelove.flockofart.com/uploads/1/3/0/8/130874104/botakila-sabufumaziwenu-pinejivutaf-pivigumegogiriv.pdf
• http://tujebeg.shopamityvilleapothecary.com/uploads/1/3/1/3/131383483/pimokis.pdf
• http://wivupafel.fatherbrowning.com/uploads/1/3/1/8/131856331/4826230.pdf
• http://files.subterfuge-au.com/uploads/1/3/0/7/130738841/17219b5a.pdf
• https://cdn.shopify.com/s/files/1/0441/0467/9576/files/basic_electronics_textbook_free_download.pdf
• https://cdn.shopify.com/s/files/1/0439/8999/1582/files/75157296733.pdf
• https://cdn.shopify.com/s/files/1/0433/0579/5752/files/automatic_door_bell_with_object_detection.pdf
• https://cdn.shopify.com/s/files/1/0430/9575/2858/files/dd_5e_deities_and_demigods.pdf
• https://cdn.shopify.com/s/files/1/0434/1510/9794/files/beposixodivonomoni.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/

Embedded domains

• ttraff.ru
• files.rachelwoodwardhansen.com
• wexopak.notsuchsecretlife.com
• files.isoandbusinessexpert.com
• files.strangelight.org
• files.bookworldtravel.com
• rixuzane.mrmobileomaha.com
• files.knockouthumor.com
• vutadedas.chinookwritingandjournaling.com
• files.glassbynanc.com
• files.legacy-creek.com
• dinelove.flockofart.com
• tujebeg.shopamityvilleapothecary.com
• wivupafel.fatherbrowning.com
• files.subterfuge-au.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report