MALICIOUS — 035627_c19c9c78b8524fa48c607185abee6824.pdf

MALICIOUS — 035627_c19c9c78b8524fa48c607185abee6824.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 7ae1edd9d13baa3160ace3f13b1ea7769d5ff23639905199f9fb82d284050c76
• SHA-1: ef048a01cc81e09b3873559faf4027e341bb282e
• MD5: c45a1d144e7a65d3f7116e082565e8dd
• ssdeep: 768:OgGzpDNXkCOqEVNzBRde0FOAvsS8dl6mLikfI4Pq/97C:rGFJ2Ddec8XvnPq/9O
• TLSH: T17D329DF344A7ED8C7DDB4B43ADAA1249244596897133A76049D87B2CC8BC2BDBF40871
• Submitted as: 035627_c19c9c78b8524fa48c607185abee6824.pdf
• File type: pdf · Size: 43942 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=clases+de+dibujos+tecnicos, https://89d0399d-01fa-4124-bd35-d3acce75e49c.filesusr.com/ugd/76aeb6_efc90f1eab944cb18d37993daa46c983.pdf?index=true, https://5bd08710-670f-40e0-904a-18929f37303d.filesusr.com/ugd/b90ba1_9329497b1f2b41f8902c4d90e5759253.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=clases+de+dibujos+tecnicos
• https://89d0399d-01fa-4124-bd35-d3acce75e49c.filesusr.com/ugd/76aeb6_efc90f1eab944cb18d37993daa46c983.pdf?index=true
• https://5bd08710-670f-40e0-904a-18929f37303d.filesusr.com/ugd/b90ba1_9329497b1f2b41f8902c4d90e5759253.pdf?index=true
• https://e62e1759-ea5f-4687-9864-bfeaa143c02d.filesusr.com/ugd/9df9d6_b142d02c92b74310a92396841f29a819.pdf?index=true
• https://d84958f8-ad2f-4874-958a-49cafecf37d9.filesusr.com/ugd/3ed902_641188b851dd4d0c996171b424eaf326.pdf?index=true
• https://cdn.shopify.com/s/files/1/0433/0808/9499/files/blockchain_cryptocurrency_regulation_2020.pdf
• https://cdn.shopify.com/s/files/1/0429/6251/8182/files/girepazirikij.pdf
• https://cdn.shopify.com/s/files/1/0481/9756/6616/files/worksheet_5_combined_gas_law_problems.pdf
• https://cdn.shopify.com/s/files/1/0433/4210/2679/files/back_button_action_in_android.pdf
• https://df7a2c21-13a1-4929-8e84-9917587d856a.filesusr.com/ugd/565485_8d73ce472e164f8da399624b84be9528.pdf?index=true
• https://42c96d3b-411e-4100-a0cc-3e42c25e3a09.filesusr.com/ugd/154db6_20c8913494244b0d9413fc98e1a82726.pdf?index=true
• https://81175baa-3830-4166-bffe-9bd1b87f352a.filesusr.com/ugd/eb6612_664921a5dd144860a9b488292b3f9f94.pdf?index=true
• https://ec675336-941a-4909-a858-e8c5d004dad9.filesusr.com/ugd/eb6612_189f02e4c53648caa38571733287d66b.pdf?index=true
• https://1e20613e-b4fd-486e-aea2-5c8d840a24db.filesusr.com/ugd/696117_bcc0926bf7db48468c5e329df03becff.pdf?index=true
• https://70545432-771a-4e9f-bc2c-9ce55be819d0.filesusr.com/ugd/33ab24_05519f0568104230ba5b9ec0b47bb30a.pdf?index=true
• https://1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com/ugd/227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf?index=true
• https://1fe9b630-f808-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/2b25b5_485d793debeb45bd9250f5940c6ed34d.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 89d0399d-01fa-4124-bd35-d3acce75e49c.filesusr.com
• 5bd08710-670f-40e0-904a-18929f37303d.filesusr.com
• e62e1759-ea5f-4687-9864-bfeaa143c02d.filesusr.com
• d84958f8-ad2f-4874-958a-49cafecf37d9.filesusr.com
• cdn.shopify.com
• df7a2c21-13a1-4929-8e84-9917587d856a.filesusr.com
• 42c96d3b-411e-4100-a0cc-3e42c25e3a09.filesusr.com
• 81175baa-3830-4166-bffe-9bd1b87f352a.filesusr.com
• ec675336-941a-4909-a858-e8c5d004dad9.filesusr.com
• 1e20613e-b4fd-486e-aea2-5c8d840a24db.filesusr.com
• 70545432-771a-4e9f-bc2c-9ce55be819d0.filesusr.com
• 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
• 1fe9b630-f808-11ea-a328-fc4dd43d38a6.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report