MALICIOUS — cf9ff1_2306eaf6c7424d0d86e6958e68d2adb2.pdf

MALICIOUS — cf9ff1_2306eaf6c7424d0d86e6958e68d2adb2.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 77f8d35a79514ff1c2ef95f3ef2028c357450d1b1b8c8473692e5c6bfb1a18e3
• SHA-1: f9c5c355084058e1c9328f0de57f8db910e40213
• MD5: d6ffea03b49851413f48b3ab25ce63cc
• ssdeep: 768:7gGzpDcu0p2iKJYQL37dfWQHPXwNLOje1jX8ygGCFoTfXZEn:EGFY/2hiq7gQPhydCijXZEn
• TLSH: T1F8329EF750A3EC4C768B9B03AEE7145A9146DBC964329AA418C8776CC0BC3FD6E10A51
• Submitted as: cf9ff1_2306eaf6c7424d0d86e6958e68d2adb2.pdf
• File type: pdf · Size: 46265 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=mta+civil+service+exam+study+guides, http://jamov.raeleensfancyfaces.com.au/uploads/1/3/0/8/130874429/rofej-roxebesikapefu-gewizewapes-xizigivep.pdf, http://kasogifix.spiritforyourlife.com/uploads/1/3/1/4/131482993/kelijeseloxezivi.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=mta+civil+service+exam+study+guides
• http://jamov.raeleensfancyfaces.com.au/uploads/1/3/0/8/130874429/rofej-roxebesikapefu-gewizewapes-xizigivep.pdf
• http://kasogifix.spiritforyourlife.com/uploads/1/3/1/4/131482993/kelijeseloxezivi.pdf
• http://files.massagestinkypro.com/uploads/1/3/1/1/131164440/xaponixipivuvi_wumiwol_firitovadakom.pdf
• http://pipon.evapfaff.com/uploads/1/3/1/4/131437252/texag-munuba.pdf
• http://files.my-digital-dude.com/uploads/1/3/0/7/130775539/jesovalaje.pdf
• http://files.globalbookrights.com/uploads/1/3/0/7/130776795/a3e0744f8.pdf
• http://files.michelle-kessler.com/uploads/1/3/0/7/130776720/zoradosegofiwus-mozefunigirimo-wowedulimu.pdf
• http://gomaliwij.johnstephenbritten.com/uploads/1/3/1/8/131857782/409865ba16f9011.pdf
• http://files.ridgeap.com/uploads/1/3/2/7/132741339/2238836.pdf
• https://cdn.shopify.com/s/files/1/0440/2741/2645/files/user_manual_for_samsung_plasma_tv.pdf
• https://cdn.shopify.com/s/files/1/0437/0166/5960/files/8th_grade_word_problems_worksheets.pdf
• https://cdn.shopify.com/s/files/1/0438/4810/6134/files/53708849967.pdf
• https://cdn.shopify.com/s/files/1/0432/0264/2075/files/togojopajixiz.pdf
• https://cdn.shopify.com/s/files/1/0434/0065/9100/files/tenupidaxufofef.pdf
• https://cdn.shopify.com/s/files/1/0434/5082/6905/files/my_catholic_faith_delivered_answers.pdf
• https://cdn.shopify.com/s/files/1/0438/1795/9586/files/kasapigu.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• jamov.raeleensfancyfaces.com.au
• kasogifix.spiritforyourlife.com
• files.massagestinkypro.com
• pipon.evapfaff.com
• files.my-digital-dude.com
• files.globalbookrights.com
• files.michelle-kessler.com
• gomaliwij.johnstephenbritten.com
• files.ridgeap.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report