MALICIOUS — a2de88_a1fdbdf463e74ed38d38c17b68e4eb67.pdf

MALICIOUS — a2de88_a1fdbdf463e74ed38d38c17b68e4eb67.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 80456f8bccbf295d08763e5dc353c9b65492ab25990f7f1f0b7addb821644fd3
• SHA-1: e127dbc46ae54481d74ef6774570843bddc3bfa7
• MD5: 117dc5926f05e112ec777740e56a1bfc
• ssdeep: 768:qPgGzpD/AM1C/bCVme2UBAeNSJmmVJ8ILKxig/83Ld8aY5Qp+YkWPrQOs:zGFrv1aCoNUBAeNS3VdexigU3xjY58kT
• TLSH: T1BB328EF3519BDD8C79C76B036DAA20695146C78C62239B6454C87B3CC9BC2BC7E91930
• Submitted as: a2de88_a1fdbdf463e74ed38d38c17b68e4eb67.pdf
• File type: pdf · Size: 46231 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=business+statistics+for+contemporary+decision+making+6th+edition+pdf, https://a6a5c0a6-3249-43cc-9bfd-158385f647ec.filesusr.com/ugd/98e298_3b64ac78264a4a3e90533269a18ddcdb.pdf?index=true, https://fc9d7037-f0a3-472b-864c-648dcf18e126.filesusr.com/ugd/a76634_9fe17097b5ab4152ac6df619ee32121a.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=business+statistics+for+contemporary+decision+making+6th+edition+pdf
• https://a6a5c0a6-3249-43cc-9bfd-158385f647ec.filesusr.com/ugd/98e298_3b64ac78264a4a3e90533269a18ddcdb.pdf?index=true
• https://fc9d7037-f0a3-472b-864c-648dcf18e126.filesusr.com/ugd/a76634_9fe17097b5ab4152ac6df619ee32121a.pdf?index=true
• https://6a8f0347-912f-48c8-a1a2-ed4d606c86e2.filesusr.com/ugd/6cabbb_4125cd686b19465a86fe2d10678b2bdb.pdf?index=true
• https://3fb2e918-1dda-47cf-9eeb-e4dc2435cf99.filesusr.com/ugd/33a16d_e4f1dd86b1164cb8bee8b1805feb725f.pdf?index=true
• https://c978bc9b-1b70-433d-96d8-6c09901b834c.filesusr.com/ugd/bcfc12_b6cd3787f38c4d3b97f6fc32071c0478.pdf?index=true
• https://0b3d060a-92d2-49e8-9a01-a88e00d94819.filesusr.com/ugd/bb4607_4280444d98aa45d1a3fe7f8cda0f1e32.pdf?index=true
• https://01c24193-ab88-47c7-821e-025ee62c4519.filesusr.com/ugd/c12414_312be9bfc1a0448283632f09b77b0a05.pdf?index=true
• https://b5391c0f-1573-41c9-91e7-38928baedb59.filesusr.com/ugd/02631b_516209b45f1f4287bcd8d2dc433acc1d.pdf?index=true
• https://df8300be-2428-4e35-a6fc-a3257544035c.filesusr.com/ugd/08338c_4349faab21d142d2bfa3b4e7da32fccf.pdf?index=true
• http://files.kappagammadelta.org/uploads/1/3/0/7/130775700/likadozojonasopiko.pdf
• http://files.escondidoartassociation.com/uploads/1/3/0/9/130969992/6b6bb98.pdf
• http://ladegux.vldesignsgifts.com/uploads/1/3/1/3/131384244/wufukudafonatinozo.pdf
• http://dejid.reinmotivation.com/uploads/1/3/1/3/131398473/02a4cc49.pdf
• http://files.miikakarppinen.com/uploads/1/3/2/8/132815359/9258109.pdf
• https://1ac2d501-7579-4cdc-b730-7e474f60ad9a.filesusr.com/ugd/60e703_7d6c6fbae44a43a3814916397246c65d.pdf?index=true
• https://2575a91a-a411-4d61-b682-edcad8e749ea.filesusr.com/ugd/ad2ade_81d0ca60d69c4591953f3ef30ba5f60f.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• a6a5c0a6-3249-43cc-9bfd-158385f647ec.filesusr.com
• fc9d7037-f0a3-472b-864c-648dcf18e126.filesusr.com
• 6a8f0347-912f-48c8-a1a2-ed4d606c86e2.filesusr.com
• 3fb2e918-1dda-47cf-9eeb-e4dc2435cf99.filesusr.com
• c978bc9b-1b70-433d-96d8-6c09901b834c.filesusr.com
• 0b3d060a-92d2-49e8-9a01-a88e00d94819.filesusr.com
• 01c24193-ab88-47c7-821e-025ee62c4519.filesusr.com
• b5391c0f-1573-41c9-91e7-38928baedb59.filesusr.com
• df8300be-2428-4e35-a6fc-a3257544035c.filesusr.com
• files.kappagammadelta.org
• files.escondidoartassociation.com
• ladegux.vldesignsgifts.com
• dejid.reinmotivation.com
• files.miikakarppinen.com
• 1ac2d501-7579-4cdc-b730-7e474f60ad9a.filesusr.com
• 2575a91a-a411-4d61-b682-edcad8e749ea.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report