MALICIOUS — eb6612_990241b926ab448e89c3fa275371c006.pdf

MALICIOUS — eb6612_990241b926ab448e89c3fa275371c006.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 84cc9ca6bfd33526534e516fe9b747d256b84800511126afd7aa41048d077ef7
• SHA-1: 2e852551055a1f5b01cf9f74d96ac7a4ace12efe
• MD5: 850e80cacb8f90621d022ca5d5762493
• ssdeep: 768:9gGzpDWpfFCkUN6Kj8XxaMqy+QytJvBlouGv5/9/AbXOnl+l:+GFKVFXXxiy+jvBlouw/9/Eml+l
• TLSH: T13533BFF3149BED4D79C69F53ACEA0159618AD38D6232AB601498776CC03C3FDAE40E61
• Submitted as: eb6612_990241b926ab448e89c3fa275371c006.pdf
• File type: pdf · Size: 50253 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=business+income+worksheet+template, http://files.woodshoppe100.com/uploads/1/3/1/4/131453712/tasuzaluz.pdf, http://files.mysweatshops.com/uploads/1/3/1/6/131606819/pikesejezese.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=business+income+worksheet+template
• http://files.woodshoppe100.com/uploads/1/3/1/4/131453712/tasuzaluz.pdf
• http://files.mysweatshops.com/uploads/1/3/1/6/131606819/pikesejezese.pdf
• http://files.klaboratory.org/uploads/1/3/2/8/132814136/4452220.pdf
• http://files.lovehomeandgardenmakeovers.co.uk/uploads/1/3/2/7/132710491/rodufiwitesi-rolonarugos-neziz-fabirib.pdf
• https://644741c7-10c1-4c23-be3f-84ce93b5938b.filesusr.com/ugd/227d0f_d04c91705cf94f2993f3080df87512a0.pdf?index=true
• https://469eb19a-9819-4075-be1c-722605d85167.filesusr.com/ugd/a2de88_5e595244c2ae4acfb8be1c2f5eb75eb7.pdf?index=true
• https://ba8d818c-dcdc-4476-9845-37f10e7b1367.filesusr.com/ugd/dcf9ad_39142074fab44e5197f14f79ca6f1c84.pdf?index=true
• https://65de848e-d464-464c-be7d-7e63fa8691b1.filesusr.com/ugd/3ed902_bdbc49b3518d4198b2756a66f103adb2.pdf?index=true
• https://4af0a01b-7cbc-4e2e-856e-cbe8ecd02381.filesusr.com/ugd/18f527_3d02f6ef78ae46ad9000f6d857408126.pdf?index=true
• https://65a676bc-0694-4ff5-87b2-4507a04416b4.filesusr.com/ugd/89064d_5aba75ee95bf4fc7aaa6781438956d71.pdf?index=true
• https://19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com/ugd/9df9d6_d200703251a848a6b97a32655d8de01f.pdf?index=true
• https://87abbf3c-220e-4f82-813a-c3ac0df448fb.filesusr.com/ugd/f91cf1_a2e1902e21ac4be88024b48c92a35c0e.pdf?index=true
• https://cdn.shopify.com/s/files/1/0465/2865/9614/files/31879755987.pdf
• https://cdn.shopify.com/s/files/1/0432/0215/0557/files/46867717552.pdf
• https://cdn.shopify.com/s/files/1/0433/4449/4750/files/32278958699.pdf
• https://cdn.shopify.com/s/files/1/0436/3295/1446/files/pesevagizurorugularaseze.pdf
• https://cdn.shopify.com/s/files/1/0432/5038/5051/files/xebek.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• files.woodshoppe100.com
• files.mysweatshops.com
• files.klaboratory.org
• files.lovehomeandgardenmakeovers.co.uk
• 644741c7-10c1-4c23-be3f-84ce93b5938b.filesusr.com
• 469eb19a-9819-4075-be1c-722605d85167.filesusr.com
• ba8d818c-dcdc-4476-9845-37f10e7b1367.filesusr.com
• 65de848e-d464-464c-be7d-7e63fa8691b1.filesusr.com
• 4af0a01b-7cbc-4e2e-856e-cbe8ecd02381.filesusr.com
• 65a676bc-0694-4ff5-87b2-4507a04416b4.filesusr.com
• 19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com
• 87abbf3c-220e-4f82-813a-c3ac0df448fb.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report