MALICIOUS — 69695d_ee470f03209b4a97b413c8f57cbf2894.pdf

MALICIOUS — 69695d_ee470f03209b4a97b413c8f57cbf2894.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 85cf9abcab3908769b5c2067cc3236a1e52808fb6c00cd03bb9c7eed59126987
• SHA-1: 9455949ace37aab450e7edb9425818b8acd9bd28
• MD5: 7084dbbdd3de130edcd32d7f9671dc47
• ssdeep: 768:VgGzpDXXdk5Uue6ubVxEDwQnICIPswKCBbdUGsEgDQyK3amT0KYSWl4IaB13+OiE:GGFrGxkVGrngMREgMyuFYbSWlJO4OiE
• TLSH: T184348EF350D7ED8C6BCB6F136DA715AA5447CB892136A66004C87B3CC8BC6BC5E40A61
• Submitted as: 69695d_ee470f03209b4a97b413c8f57cbf2894.pdf
• File type: pdf · Size: 54312 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=adw+launcher+2+premium+apk+2.0.1.70, http://files.homeofourown.org/uploads/1/3/0/7/130775858/2e3e5aca50fa4f6.pdf, http://wujotevat.bmorewell.com/uploads/1/3/1/4/131452743/f1a3f9afc10342.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=adw+launcher+2+premium+apk+2.0.1.70
• http://files.homeofourown.org/uploads/1/3/0/7/130775858/2e3e5aca50fa4f6.pdf
• http://wujotevat.bmorewell.com/uploads/1/3/1/4/131452743/f1a3f9afc10342.pdf
• http://files.conciergepainrelief.com/uploads/1/3/2/3/132303060/2989523.pdf
• http://komavofa.mountainviewmentalhealth.com/uploads/1/3/0/8/130873987/temin.pdf
• http://remuxeje.theolivegrovecmc.com/uploads/1/3/1/4/131437364/9784894dbdfb7a7.pdf
• http://tijex.augustiniana.net/uploads/1/3/2/3/132303307/e08d62be5d7.pdf
• http://files.kaiserfarmfresh.com/uploads/1/3/0/9/130969990/3438223.pdf
• http://files.lascolinaspsych.com/uploads/1/3/1/3/131378771/tenofoxarezefisudiz.pdf
• http://files.hannahsclassroom.com/uploads/1/3/2/7/132712139/mefotusirog_motosalaruwegoj_bosur.pdf
• http://files.laurakretz.com/uploads/1/3/1/8/131857364/c1f6b85ad.pdf
• http://wimes.adelaidefamefestival2020.com/uploads/1/3/0/8/130873851/tikew-xuxib-gigufude-fajagim.pdf
• http://files.create-diy-online.com/uploads/1/3/1/6/131606262/kizojoxo-mifufojegaxuf.pdf
• https://80cf1e65-6f51-4fe1-bcb7-d0a3e674410e.filesusr.com/ugd/a4ea6c_b7784cb1ec47451d945df13fc3137bcf.pdf?index=true
• https://82137b76-225a-4757-8729-0ebe6a481922.filesusr.com/ugd/70e7d4_2924701c98674df1888078fd40a3829a.pdf?index=true
• https://735c0868-4d45-46c4-b23a-ffd36e08e37a.filesusr.com/ugd/defcb2_4a4c32b585544342aa88be3c7ec3a259.pdf?index=true
• https://b9d95e1b-5e1f-4ebe-9c3e-91e86c13bd15.filesusr.com/ugd/173616_627107ff0ce44ddd9e53ed601fd88bcb.pdf?index=true
• https://37ce7cf5-2fb5-46ac-8602-477932fe7516.filesusr.com/ugd/5438e3_5dbe5e334d314daf8f1768da856d9aa7.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• files.homeofourown.org
• wujotevat.bmorewell.com
• files.conciergepainrelief.com
• komavofa.mountainviewmentalhealth.com
• remuxeje.theolivegrovecmc.com
• tijex.augustiniana.net
• files.kaiserfarmfresh.com
• files.lascolinaspsych.com
• files.hannahsclassroom.com
• files.laurakretz.com
• wimes.adelaidefamefestival2020.com
• files.create-diy-online.com
• 80cf1e65-6f51-4fe1-bcb7-d0a3e674410e.filesusr.com
• 82137b76-225a-4757-8729-0ebe6a481922.filesusr.com
• 735c0868-4d45-46c4-b23a-ffd36e08e37a.filesusr.com
• b9d95e1b-5e1f-4ebe-9c3e-91e86c13bd15.filesusr.com
• 37ce7cf5-2fb5-46ac-8602-477932fe7516.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Embedded IP addresses

• 2.0.1.70
• 2.0.1.7

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report