MALICIOUS — 60ffa2_28a4876b356b4d01ba91fd720fa4fe4e.pdf

MALICIOUS — 60ffa2_28a4876b356b4d01ba91fd720fa4fe4e.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 7482b14c2ca783155f92d5772492cc9fb99017c3788e9f8e9e64a36f4846374c
• SHA-1: 9c83f65b40b726924b111944e8b175ceca073b63
• MD5: 658187e6450997dde1fbeeed6ed29064
• ssdeep: 768:pgGzpD/fa1b2zwGbPaZGqNSVLgF8NCkiEvygT81b6hXeXiiqHzVrGlIYyz:KGFbfoZ1N4Cki4yg4b6hXxTVrEIYyz
• TLSH: T11A33BFF36057EE4C379FAB03BEE914696445F64DA076D3A048D8766CC4786ECAF10A20
• Submitted as: 60ffa2_28a4876b356b4d01ba91fd720fa4fe4e.pdf
• File type: pdf · Size: 48203 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=california+missions+report, https://3efe6515-cf04-40db-944e-b0c4747fe731.filesusr.com/ugd/5e8de6_c89cc652d76148fd937a387af7c870a0.pdf?index=true, https://ae284a58-6dd6-49e3-9f30-df7c87d8023e.filesusr.com/ugd/61b8bf_ac9d21a149634d0183137d332b2d61f3.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=california+missions+report
• https://3efe6515-cf04-40db-944e-b0c4747fe731.filesusr.com/ugd/5e8de6_c89cc652d76148fd937a387af7c870a0.pdf?index=true
• https://ae284a58-6dd6-49e3-9f30-df7c87d8023e.filesusr.com/ugd/61b8bf_ac9d21a149634d0183137d332b2d61f3.pdf?index=true
• https://ff389f73-cce3-4938-8902-cafdbc69ac19.filesusr.com/ugd/b81754_83eda3926cd94621b79a123046739a3b.pdf?index=true
• https://f0743c83-acac-455b-bcb7-94b3524bd66a.filesusr.com/ugd/2486b5_d2f85e75bb21494c892c96ed313833ce.pdf?index=true
• http://files.liznoelcounselor.com/uploads/1/3/1/3/131381693/riloxiwikef.pdf
• https://cdn.shopify.com/s/files/1/0440/5297/1685/files/mackerel_run_korean_drama_free.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/zenafepejeviwasi.pdf
• https://cdn.shopify.com/s/files/1/0461/3482/1032/files/intercontinental_hotels_group_plc_annual_report.pdf
• https://cdn.shopify.com/s/files/1/0438/0416/4257/files/99937175375.pdf
• https://cd0d4083-0406-491f-912d-c3fc55791231.filesusr.com/ugd/b463f2_10a3f81de7324bf7813d75898f8465fa.pdf?index=true
• https://a4548a24-c87f-4473-b5bf-18faa5143980.filesusr.com/ugd/dec231_ff45e7e7a05840aa84552aff1e7dfadc.pdf?index=true
• https://94a51085-16d8-43e8-8a7b-9afcb2cb2a44.filesusr.com/ugd/3f8d85_332f7b792ea248568c7c91cbc6b72c42.pdf?index=true
• https://02969fbf-311a-4769-bdf3-60a03c8e71f7.filesusr.com/ugd/681527_bcf7ecb3899a4bb1a0dfd0e9340e13bf.pdf?index=true
• https://68ae794b-5610-4c69-9c04-e5b1b897862e.filesusr.com/ugd/4fb05f_3c382d43a92542b19688b3af08f9ce22.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• 3efe6515-cf04-40db-944e-b0c4747fe731.filesusr.com
• ae284a58-6dd6-49e3-9f30-df7c87d8023e.filesusr.com
• ff389f73-cce3-4938-8902-cafdbc69ac19.filesusr.com
• f0743c83-acac-455b-bcb7-94b3524bd66a.filesusr.com
• files.liznoelcounselor.com
• cdn.shopify.com
• cd0d4083-0406-491f-912d-c3fc55791231.filesusr.com
• a4548a24-c87f-4473-b5bf-18faa5143980.filesusr.com
• 94a51085-16d8-43e8-8a7b-9afcb2cb2a44.filesusr.com
• 02969fbf-311a-4769-bdf3-60a03c8e71f7.filesusr.com
• 68ae794b-5610-4c69-9c04-e5b1b897862e.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report