MALICIOUS — 7dd30d_c74dae70e9ca43508d97352c6bc393df.pdf

MALICIOUS — 7dd30d_c74dae70e9ca43508d97352c6bc393df.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 78dd6354965a20998d3e1e3c2a134ae8f48d28673e12febebb50096b3da948a5
SHA-1: fb4cafee95e4465f33799366683b1af335f31e9d
MD5: 8952391c6bda4b90b1cda62aafe54688
ssdeep: 768:bgGzpDRLg192GCBKs4fiObSgIwYW8OQEAmIdflR6KF6D8tiyZxPJh2JGiff:kGF9Lg1X6FB5Hl0Ku0wJGiff
TLSH: T1BD33AEF750B7EC8C36879B1369AA252D500AE34C6132977499D8BB6CC47C3BDAF10920
Submitted as: 7dd30d_c74dae70e9ca43508d97352c6bc393df.pdf
File type: pdf · Size: 49026 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.club/wix?keyword=blacksmith+colonial+times+wikipedia, https://cdn.shopify.com/s/files/1/0443/0443/3308/files/terraria_thorium_mod_bard_class_guide.pdf, https://cdn.shopify.com/s/files/1/0434/3152/6557/files/3876729535.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.club/wix?keyword=blacksmith+colonial+times+wikipedia
https://cdn.shopify.com/s/files/1/0443/0443/3308/files/terraria_thorium_mod_bard_class_guide.pdf
https://cdn.shopify.com/s/files/1/0434/3152/6557/files/3876729535.pdf
https://cdn.shopify.com/s/files/1/0433/9263/0940/files/conan_exiles_ps4_crafting_guide.pdf
https://cdn.shopify.com/s/files/1/0428/8544/7833/files/yahoo_mail_app_pc.pdf
http://files.artsyus.com/uploads/1/3/1/1/131164398/moboxe-wiradaz.pdf
http://xipufud.imaniyako.org/uploads/1/3/2/3/132302868/dipuve_bodoj_dakival_tutipiwiw.pdf
http://gokebifop.umneofellow.org/uploads/1/3/2/6/132695832/d45f31.pdf
http://tixukelud.educationinno.org/uploads/1/3/2/8/132816042/4b94d.pdf
https://cdn.shopify.com/s/files/1/0430/8113/8343/files/daveburam.pdf
https://cdn.shopify.com/s/files/1/0437/2824/0794/files/free_lagu_andmesh_cinta_luar_biasa.pdf
https://6b4389b3-1ea3-4373-be44-ec60cbc8ce5d.filesusr.com/ugd/e50c99_feb4d9e6298b4ac997d9aa3a07f8427f.pdf?index=true
https://8f2a93a9-e5af-4862-9dbc-463086f3e67f.filesusr.com/ugd/6924eb_01605b890eb6498ebd1be03eca2e83fb.pdf?index=true
https://869b487c-bf55-4400-9239-d5bd56abc36b.filesusr.com/ugd/3cb679_a79c62d3918a4439bb3cf1cbf566d42f.pdf?index=true
https://48ad1c63-76f0-4eac-99e6-32d0ea49c864.filesusr.com/ugd/cfbfd2_51221caf138242ebbf2b85dba24f9fa6.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.club
cdn.shopify.com
files.artsyus.com
xipufud.imaniyako.org
gokebifop.umneofellow.org
tixukelud.educationinno.org
6b4389b3-1ea3-4373-be44-ec60cbc8ce5d.filesusr.com
8f2a93a9-e5af-4862-9dbc-463086f3e67f.filesusr.com
869b487c-bf55-4400-9239-d5bd56abc36b.filesusr.com
48ad1c63-76f0-4eac-99e6-32d0ea49c864.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report