MALICIOUS — 0af078_0088396957534b62beaaaf4f415ae176.pdf
MALICIOUS — 0af078_0088396957534b62beaaaf4f415ae176.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 53 detection engines flagged it.
Identification
- SHA-256:
806058b90e7cfbeb32239d89a4b269be34d259e4fdae6b9746d6eab4f28f8f2c - SHA-1:
092e61b61eb87a4f89ebe8bb670f6efef714d327 - MD5:
97dfc4ca1475887d4131d4e97bf4f353 - ssdeep:
768:7gGzpDjo8s0Z+Np8/U7nyNSALRnwy3JM8WFe131ffnnBEUV7S2oNnRf8oT:EGFXlC8/UMTnlJnXtn+UZSfxRf8oT - TLSH:
T169339EF344A3ED8C764E9B03AAEB1118514AD6CD6132D76819987F2DC07C6FE6F50920 - Submitted as: 0af078_0088396957534b62beaaaf4f415ae176.pdf
- File type: pdf · Size: 49262 bytes
- Verdict: malicious (94/100)
Detections (4 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: Trojan:PDF/Phish!atmn
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen
Why this verdict
The malicious score of 94/100 is the fusion of 7 weighted signals:
- Microsoft Defender flagged Trojan:PDF/Phish!atmn (rule
Trojan:PDF/Phish!atmn) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule
UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.ru/wix?keyword=black+man+in+a+white+coat+pdf, https://a59ae342-221d-429c-8d83-b9b82318dc2d.filesusr.com/ugd/5bb01c_795b1e1f6d6648c18f7eeee5c0caf651.pdf?index=true, https://bdeeb94d-6e2e-46e7-aca6-da0c6e6c8841.filesusr.com/ugd/b463f2_f1cb1c406d1f45cd825feeb287e099cf.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.ru/wix?keyword=black+man+in+a+white+coat+pdf
- https://a59ae342-221d-429c-8d83-b9b82318dc2d.filesusr.com/ugd/5bb01c_795b1e1f6d6648c18f7eeee5c0caf651.pdf?index=true
- https://bdeeb94d-6e2e-46e7-aca6-da0c6e6c8841.filesusr.com/ugd/b463f2_f1cb1c406d1f45cd825feeb287e099cf.pdf?index=true
- https://bad34726-dd57-4a81-b16f-12a794e2eb40.filesusr.com/ugd/bfbc46_f6a6404ffd864f2c97df0b57ed73418d.pdf?index=true
- https://4cfb42d7-3be0-4a7b-9826-9bd15b932603.filesusr.com/ugd/eb6612_2b1fcd45d33c42c39879e13704328cd8.pdf?index=true
- https://dbbad3d7-5075-4501-bb26-3b5493457a96.filesusr.com/ugd/18f527_ec20d68874224603b333e41ddc4c0d3f.pdf?index=true
- https://89d0399d-01fa-4124-bd35-d3acce75e49c.filesusr.com/ugd/76aeb6_efc90f1eab944cb18d37993daa46c983.pdf?index=true
- https://1600ca33-195a-483f-8d68-725bc30f3980.filesusr.com/ugd/3be48b_2f8c495ac0f84a23b9de9d821f5a776e.pdf?index=true
- https://79a463be-abc4-4d9e-8e16-6abcf3ecc750.filesusr.com/ugd/f08e01_0068bce556904696bfda5ead21c91b7f.pdf?index=true
- https://cdn.shopify.com/s/files/1/0465/3845/7238/files/jexifuro.pdf
- https://cdn.shopify.com/s/files/1/0430/1894/4665/files/87405373579.pdf
- https://cdn.shopify.com/s/files/1/0435/6797/2513/files/android_emulator_for_iphone_6.pdf
- https://cdn.shopify.com/s/files/1/0433/1051/4334/files/sonefefolexokireminasod.pdf
- https://cdn.shopify.com/s/files/1/0463/0367/4530/files/brain_vision_analyzer_2_user_manual.pdf
- https://9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com/ugd/3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf?index=true
- https://1637c2ce-2b6e-43f0-9153-903a86efd820.filesusr.com/ugd/89064d_3cc4a6767bbe4cac9dbfac4ba199f34f.pdf?index=true
- https://e299cd96-f5fa-4e4d-b8e8-22454be6cfe7.filesusr.com/ugd/f08e01_679e309ffc6a4bc384e90ec11d4089a6.pdf?index=true
- https://6f674aaa-49d5-433d-bbbc-d80ac13ce4c0.filesusr.com/ugd/5bb01c_8cc418c986c748e19446d53d15298ade.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.ru
- a59ae342-221d-429c-8d83-b9b82318dc2d.filesusr.com
- bdeeb94d-6e2e-46e7-aca6-da0c6e6c8841.filesusr.com
- bad34726-dd57-4a81-b16f-12a794e2eb40.filesusr.com
- 4cfb42d7-3be0-4a7b-9826-9bd15b932603.filesusr.com
- dbbad3d7-5075-4501-bb26-3b5493457a96.filesusr.com
- 89d0399d-01fa-4124-bd35-d3acce75e49c.filesusr.com
- 1600ca33-195a-483f-8d68-725bc30f3980.filesusr.com
- 79a463be-abc4-4d9e-8e16-6abcf3ecc750.filesusr.com
- cdn.shopify.com
- 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com
- 1637c2ce-2b6e-43f0-9153-903a86efd820.filesusr.com
- e299cd96-f5fa-4e4d-b8e8-22454be6cfe7.filesusr.com
- 6f674aaa-49d5-433d-bbbc-d80ac13ce4c0.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report