MALICIOUS — 0b46e6_a036c7d9373c4963b7e164267be8ca56.pdf

MALICIOUS — 0b46e6_a036c7d9373c4963b7e164267be8ca56.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 734c21030805d1dea77387d4a9664c6575b94f0d6dd86108f2616d705ec57257
• SHA-1: 81c497cd1c867cf745ed6bb1501912d50c94423d
• MD5: 27f4e60b0aba4f5585e8788edb8f2ab0
• ssdeep: 768:FgGzpDG/ZTuidOawWtQu8XRZq6W6H34X2E6e9gCCTj:WGFC/RCW+u8Xq6dX4X2EBgCCTj
• TLSH: T1FB319EF3419BED8D7ACB5F036DA61199A489E389703792604998372CD47C3BDAF04A31
• Submitted as: 0b46e6_a036c7d9373c4963b7e164267be8ca56.pdf
• File type: pdf · Size: 42163 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=sample+letter+to+reduce+traffic+fine+south+africa, https://68cad1d0-b83e-40ae-b61c-3a4cf9436a29.filesusr.com/ugd/868b90_4730197693904c40a9c28b9e04b3fb41.pdf?index=true, https://67291667-01be-4d08-874b-674889214e04.filesusr.com/ugd/e2c250_d7e6739a31994efcbd7920b30b01fe97.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=sample+letter+to+reduce+traffic+fine+south+africa
• https://68cad1d0-b83e-40ae-b61c-3a4cf9436a29.filesusr.com/ugd/868b90_4730197693904c40a9c28b9e04b3fb41.pdf?index=true
• https://67291667-01be-4d08-874b-674889214e04.filesusr.com/ugd/e2c250_d7e6739a31994efcbd7920b30b01fe97.pdf?index=true
• https://73050b70-d0b4-430a-8096-2f2ced275d82.filesusr.com/ugd/02beb7_04ef723bb4b1457ea9856ecbb05695b3.pdf?index=true
• https://e36eb27b-8e88-4c8c-832c-3ee4967bea9a.filesusr.com/ugd/359e64_11d8299ea13e47c28115ad529261d83a.pdf?index=true
• https://9c05afd2-1a8b-43f5-adf8-0587100365ff.filesusr.com/ugd/b463f2_8bf53c5d9c8b4613a31019dbfdb534de.pdf?index=true
• http://files.katherinefusco.com/uploads/1/3/1/4/131453267/xalim.pdf
• http://keref.capecodgypsea.com/uploads/1/3/0/8/130874011/pegatiritizuvu.pdf
• http://files.yunaia.com/uploads/1/3/1/4/131483830/bevuzanewokip.pdf
• http://bemajirod.belizesportsoutreach.com/uploads/1/3/0/7/130775166/fapomi.pdf
• http://nadexonu.blatteislaw.com/uploads/1/3/1/4/131408024/5ec0f9ec06.pdf
• https://cdn.shopify.com/s/files/1/0447/8962/9079/files/89311057070.pdf
• https://cdn.shopify.com/s/files/1/0437/3017/4113/files/zukuzibebimari.pdf
• https://98d140fd-2c78-4bec-9d7b-19ec47836a67.filesusr.com/ugd/54fa57_61e28cf1a5ec42caa4a6f8166a981c60.pdf?index=true
• https://0280fab1-e32f-448a-aaab-9a39155c4fd4.filesusr.com/ugd/e8506d_3da8a4c1af164769914da8b19d225de3.pdf?index=true
• https://7bb6745a-5ac6-43bc-93a6-3cf07b611e35.filesusr.com/ugd/217b8a_201828a97939410faaf4420197b75c5f.pdf?index=true
• https://da924585-7e48-407b-9ac3-534ec248e8ed.filesusr.com/ugd/03f576_484040d3455a4a44927c070d1547fbeb.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 68cad1d0-b83e-40ae-b61c-3a4cf9436a29.filesusr.com
• 67291667-01be-4d08-874b-674889214e04.filesusr.com
• 73050b70-d0b4-430a-8096-2f2ced275d82.filesusr.com
• e36eb27b-8e88-4c8c-832c-3ee4967bea9a.filesusr.com
• 9c05afd2-1a8b-43f5-adf8-0587100365ff.filesusr.com
• files.katherinefusco.com
• keref.capecodgypsea.com
• files.yunaia.com
• bemajirod.belizesportsoutreach.com
• nadexonu.blatteislaw.com
• cdn.shopify.com
• 98d140fd-2c78-4bec-9d7b-19ec47836a67.filesusr.com
• 0280fab1-e32f-448a-aaab-9a39155c4fd4.filesusr.com
• 7bb6745a-5ac6-43bc-93a6-3cf07b611e35.filesusr.com
• da924585-7e48-407b-9ac3-534ec248e8ed.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report