MALICIOUS — e1c37d_32c0d796f948428a9b80a089f97c4108.pdf

MALICIOUS — e1c37d_32c0d796f948428a9b80a089f97c4108.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 52 detection engines flagged it.

Identification

• SHA-256: 7a993a9b9b03436eeab3c4dc65f80213064c98ac1a1fccf59523687269bf7595
• SHA-1: 4b895d589ed7b2fb588cbebd4f7995a8a288e2a7
• MD5: e75eb1ece913bdfd29c26dafce2dd85f
• ssdeep: 768:mgGzpD4sIfxhdTIsNxYSs9Z98SlcDNyWA8TAEnM7YP5M7qdiy5YrRlu:zGF8xN7ns9Z6SODLAMAyBmc9Ou
• TLSH: T14B32ADF3549BED4C7A879B136EAB21191588D7886233E360518C772CC4BC6FDAE14931
• Submitted as: e1c37d_32c0d796f948428a9b80a089f97c4108.pdf
• File type: pdf · Size: 44740 bytes
• Verdict: malicious (88/100)

Detections (3 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=the+lessons+of+history+pdf+drive, http://mixifi.mikesbikepark.com/uploads/1/3/1/8/131872144/9181042.pdf, http://tuvilo.merizzi-psychotherapy.com/uploads/1/3/1/3/131398455/kofojar.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=the+lessons+of+history+pdf+drive
• http://mixifi.mikesbikepark.com/uploads/1/3/1/8/131872144/9181042.pdf
• http://tuvilo.merizzi-psychotherapy.com/uploads/1/3/1/3/131398455/kofojar.pdf
• http://files.teachermomlifeblog.com/uploads/1/3/2/6/132681477/kapudunerolev.pdf
• http://nemixo.asbeautbar.com/uploads/1/3/1/6/131606677/tiwifubobijeg.pdf
• http://files.purplelotusspiritualhealinginc.com/uploads/1/3/1/6/131606025/3808512.pdf
• https://c243e9ac-62da-4619-b244-9762394d1c21.filesusr.com/ugd/0d089b_83bd8e97ca72435780542bbc7f7bb67d.pdf?index=true
• https://d4cfd8db-457e-4917-b4b0-99950df29024.filesusr.com/ugd/595093_a67c2f042cca4639bcb2d08e11dde838.pdf?index=true
• https://c998a909-3c9e-414e-bdb5-ea5d748d6de6.filesusr.com/ugd/e3ff21_c657ce867c0c4793b9ba47c65d8db486.pdf?index=true
• https://496021b1-b7c3-4c49-9b3d-0f8343b5929e.filesusr.com/ugd/3a38e0_f39aedc112bf41efa3147cc8431eb2f5.pdf?index=true
• https://deda774c-a9ea-4669-bde2-27fe61aaec37.filesusr.com/ugd/221eaa_99f0094e0ed24d479f0c2848192edce0.pdf?index=true
• https://cdn.shopify.com/s/files/1/0437/7640/9751/files/billennium_jg_ballard.pdf
• https://cdn.shopify.com/s/files/1/0434/0855/6182/files/total_knee_replacement_procedure.pdf
• https://cdn.shopify.com/s/files/1/0440/0853/8262/files/shadowhawk_x800_instructions.pdf
• https://cdn.shopify.com/s/files/1/0430/6062/5562/files/carrom_board_game_for_jio_mobile.pdf
• https://cdn.shopify.com/s/files/1/0434/1324/2014/files/101th_constitutional_amendment_act.pdf
• https://92d8a0d6-5847-43ad-ab58-7e5139cdd328.filesusr.com/ugd/8e7730_3cfb1cd4434143eb9c34678d60fa6878.pdf?index=true
• https://7a461aa6-de8e-4238-9056-c66bf424fbee.filesusr.com/ugd/b56239_ad59eac179db47dc81844d84c0f4cf58.pdf?index=true
• https://91e8b961-994c-43bd-83a5-b0bfb1c3b2b4.filesusr.com/ugd/cf5aa9_2fc5021d3499497791badce519af1b25.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• mixifi.mikesbikepark.com
• tuvilo.merizzi-psychotherapy.com
• files.teachermomlifeblog.com
• nemixo.asbeautbar.com
• files.purplelotusspiritualhealinginc.com
• c243e9ac-62da-4619-b244-9762394d1c21.filesusr.com
• d4cfd8db-457e-4917-b4b0-99950df29024.filesusr.com
• c998a909-3c9e-414e-bdb5-ea5d748d6de6.filesusr.com
• 496021b1-b7c3-4c49-9b3d-0f8343b5929e.filesusr.com
• deda774c-a9ea-4669-bde2-27fe61aaec37.filesusr.com
• cdn.shopify.com
• 92d8a0d6-5847-43ad-ab58-7e5139cdd328.filesusr.com
• 7a461aa6-de8e-4238-9056-c66bf424fbee.filesusr.com
• 91e8b961-994c-43bd-83a5-b0bfb1c3b2b4.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report