MALICIOUS — bc0b97_19a8061498f644259eab2d0af2bc79ec.pdf

MALICIOUS — bc0b97_19a8061498f644259eab2d0af2bc79ec.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 792cd5a16d93bc6e9bfc6ca0e1b159c6d1ae7278545e2706cfd2d9d91d830ef2
• SHA-1: 16220f1ede9c92c21bbdc528d347e9c4265bafda
• MD5: daa487091a629e4bca36a37cbea0f1bb
• ssdeep: 768:ZgGzpDATE3xhKu19+CGUIDpFto4WMOaXc4X9sUzzjFWpqZJZS1uFbuPw2KK:aGFsIQoPrF46UzXFWAZJw1u5uPw2KK
• TLSH: T11A328EF350A7DC88778B9F03AEAB0455A146DB8971339AB0449C777CC9BC6ED5E01920
• Submitted as: bc0b97_19a8061498f644259eab2d0af2bc79ec.pdf
• File type: pdf · Size: 43415 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=apk+time+url+2018, http://jasezesi.giganticsequins.com/uploads/1/3/0/7/130739024/povuzawosen.pdf, http://vejozanuz.nevadateach.com/uploads/1/3/2/6/132683071/81b64ff21ff7.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=apk+time+url+2018
• http://jasezesi.giganticsequins.com/uploads/1/3/0/7/130739024/povuzawosen.pdf
• http://vejozanuz.nevadateach.com/uploads/1/3/2/6/132683071/81b64ff21ff7.pdf
• http://ruweruvi.dynamitevolleyballclub.com/uploads/1/3/1/8/131871768/nuvokolepubulilov.pdf
• http://dijatif.mid-statemta.org/uploads/1/3/0/7/130739616/fb97fe.pdf
• https://cdn.shopify.com/s/files/1/0432/1945/2063/files/pasube.pdf
• https://cdn.shopify.com/s/files/1/0434/1678/0956/files/16059213024.pdf
• http://files.50plusstickingtogether.com/uploads/1/3/1/4/131452938/498ca.pdf
• http://files.moagunworks.com/uploads/1/3/0/8/130873794/fiwarebeluzaf-puwurunaw-nidelujawojisag-mefupixewozen.pdf
• http://files.peterpetschenig.com/uploads/1/3/1/3/131378975/ca8313d7bcf6c15.pdf
• http://ginig.islandbusinessnetwork.co.uk/uploads/1/3/2/6/132695535/1ee8787.pdf
• http://tezivekug.lownsberytech.com/uploads/1/3/2/6/132682156/9043269.pdf
• https://cdn.shopify.com/s/files/1/0431/4244/7261/files/651343355.pdf
• https://cdn.shopify.com/s/files/1/0439/0882/5256/files/cataratas_del_iguazu_informacion_wikipedia.pdf
• https://cdn.shopify.com/s/files/1/0429/6015/8873/files/lubalinewovab.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• jasezesi.giganticsequins.com
• vejozanuz.nevadateach.com
• ruweruvi.dynamitevolleyballclub.com
• dijatif.mid-statemta.org
• cdn.shopify.com
• files.50plusstickingtogether.com
• files.moagunworks.com
• files.peterpetschenig.com
• ginig.islandbusinessnetwork.co.uk
• tezivekug.lownsberytech.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report