MALICIOUS — d162e3_881159bd833948a99fb27eddef964322.pdf
MALICIOUS — d162e3_881159bd833948a99fb27eddef964322.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
7b3a3e5826c3c119f5553184597756aaeba3f117b7ef39bbb19abc9bbd4d54df - SHA-1:
5424597a5f16cb48047da075649396513444a410 - MD5:
468eda9994cd20694e2f8003d2de5ba7 - ssdeep:
768:4gGzpDxgfcty0RdXK5CGYiOzY2QF/Uom6y7FOzpWnYZCaeXJRIPazg:VGF1Y5C7iOzY2QbI7FqpBCanPazg - TLSH:
T1E9319DF740A7ED4C2A8BEB435DAA251D5082D68C6033E6B068D8772CC47C3ADAF50D60 - Submitted as: d162e3_881159bd833948a99fb27eddef964322.pdf
- File type: pdf · Size: 42044 bytes
- Verdict: malicious (88/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule
UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.ru/wix?keyword=green+chemistry+analysis+of+a+mixture+guided+inquiry+answers, https://635d77b7-d21e-4fc6-95a8-398cc516b7a2.filesusr.com/ugd/0286dd_7edffc25f858472d8788ea80cd96bb22.pdf?index=true, https://e1751e7f-a46a-4e9a-8295-ea902bd7e176.filesusr.com/ugd/29c71c_67442ed6582345d4992544c6323759a2.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.ru/wix?keyword=green+chemistry+analysis+of+a+mixture+guided+inquiry+answers
- https://635d77b7-d21e-4fc6-95a8-398cc516b7a2.filesusr.com/ugd/0286dd_7edffc25f858472d8788ea80cd96bb22.pdf?index=true
- https://e1751e7f-a46a-4e9a-8295-ea902bd7e176.filesusr.com/ugd/29c71c_67442ed6582345d4992544c6323759a2.pdf?index=true
- https://2259eb6c-249a-45de-974b-994704a4ca3e.filesusr.com/ugd/89441e_44b27aefb1d6482eac1fb40f649ae507.pdf?index=true
- https://df88bed1-3df1-4a4a-a6cb-36641cd22a25.filesusr.com/ugd/12745a_0a12e2043bce4d658078a7de025a222b.pdf?index=true
- https://db756012-da7a-4df3-b349-e2e5e8567b5a.filesusr.com/ugd/33ab24_c44cadff6f3b46b5ab5645759e02cd35.pdf?index=true
- https://3fa8e829-f889-45bf-902c-ce9076cf5428.filesusr.com/ugd/57c819_e205db13bcf640959778919e1de5ac2f.pdf?index=true
- https://bffc3892-dfc1-4462-8dde-70ceb09b1f48.filesusr.com/ugd/5bf82b_6d983967b91e45a39ffd347e1cf9f339.pdf?index=true
- https://25da1cd9-757e-43ee-9329-40fe05072c31.filesusr.com/ugd/33ab24_cfd4aa60e50b4f3d9ebfbf6db5726e6a.pdf?index=true
- https://15e5f6d0-c525-49dc-b469-8e6f9329f0c8.filesusr.com/ugd/03f576_12f51233db384c649375abe5c2ae9c5b.pdf?index=true
- https://cdn.shopify.com/s/files/1/0431/6204/2529/files/sda_fundamental_beliefs_1872.pdf
- https://cdn.shopify.com/s/files/1/0437/0602/4101/files/u_of_m_anatomy.pdf
- https://6be6e2c8-8e1f-4328-af82-1b9ed0d287ae.filesusr.com/ugd/77941b_5c1434da40b94260bec430d932a52ed4.pdf?index=true
- https://b4c4a6bf-da2d-4f1d-9bdf-46295d0095c3.filesusr.com/ugd/9d7ad9_26c8ee42460c44f9ab72a5650fddf578.pdf?index=true
- https://fd7fc72b-55a2-4576-91ce-f7a3ecd4c428.filesusr.com/ugd/d7d6cd_6d4a913cfd264bcf9c4af1918aa6e969.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.ru
- 635d77b7-d21e-4fc6-95a8-398cc516b7a2.filesusr.com
- e1751e7f-a46a-4e9a-8295-ea902bd7e176.filesusr.com
- 2259eb6c-249a-45de-974b-994704a4ca3e.filesusr.com
- df88bed1-3df1-4a4a-a6cb-36641cd22a25.filesusr.com
- db756012-da7a-4df3-b349-e2e5e8567b5a.filesusr.com
- 3fa8e829-f889-45bf-902c-ce9076cf5428.filesusr.com
- bffc3892-dfc1-4462-8dde-70ceb09b1f48.filesusr.com
- 25da1cd9-757e-43ee-9329-40fe05072c31.filesusr.com
- 15e5f6d0-c525-49dc-b469-8e6f9329f0c8.filesusr.com
- cdn.shopify.com
- 6be6e2c8-8e1f-4328-af82-1b9ed0d287ae.filesusr.com
- b4c4a6bf-da2d-4f1d-9bdf-46295d0095c3.filesusr.com
- fd7fc72b-55a2-4576-91ce-f7a3ecd4c428.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report