MALICIOUS — a86d68_c9257e2e75194f04957f2f2b228851a3.pdf

MALICIOUS — a86d68_c9257e2e75194f04957f2f2b228851a3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 86d7a7958c88b04e00e9d024ba3eb46e597ea123f1be87344b423d6c084f0b9a
• SHA-1: bb1a41c1c37fcfcfb9f826b7f62d39b44266a88b
• MD5: 99114bf2cd91e0fcffc28f482566705f
• ssdeep: 768:zgGzpDO6uNua9F2d07y2WL5FzjkRKVCHzsez4zFn0P:MGFaLuaeLLvk8VFDFn0P
• TLSH: T12B34AEF3149BEC8C7AC667436DAA1594215AD788B23B9B3454D8BA3CC47C3BD6F20520
• Submitted as: a86d68_c9257e2e75194f04957f2f2b228851a3.pdf
• File type: pdf · Size: 52348 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=honeywell+mf08cesww+manual, https://a482bb61-7124-4cbd-bb6c-a4fa8c818f89.filesusr.com/ugd/136d07_fa4761409d904d4d84f38ed16841e065.pdf?index=true, https://2d21c5d9-7c31-4b83-b5e8-33c914637e9a.filesusr.com/ugd/a58502_cb151ea0695445dabeb2213ecbecd015.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=honeywell+mf08cesww+manual
• https://a482bb61-7124-4cbd-bb6c-a4fa8c818f89.filesusr.com/ugd/136d07_fa4761409d904d4d84f38ed16841e065.pdf?index=true
• https://2d21c5d9-7c31-4b83-b5e8-33c914637e9a.filesusr.com/ugd/a58502_cb151ea0695445dabeb2213ecbecd015.pdf?index=true
• https://5d859b76-c6fc-44e5-b2f6-41f77ade5da9.filesusr.com/ugd/70e5f7_19e6972d8c9d45f4a3ab42aff7ee1958.pdf?index=true
• https://494d5c9c-3482-438d-8bf1-f9182e84b8fb.filesusr.com/ugd/f1780b_5087df127cdb48dbbef7aa78271659ce.pdf?index=true
• https://caca5d0c-9c6d-457b-83ac-08261fde043b.filesusr.com/ugd/4c1554_85386bc618514dca8a09e0a45a77b59a.pdf?index=true
• http://files.designedbyjpp.co.uk/uploads/1/3/1/8/131857270/9772281.pdf
• http://files.ericheerspinkceramics.com/uploads/1/3/0/8/130873822/5cd3b0c.pdf
• http://rilag.steadfastleaders.org/uploads/1/3/2/8/132815806/6310961.pdf
• http://dareweg.davidpapo.com/uploads/1/3/1/3/131379540/bavemi_kuzidon_dexulinewozo_womegej.pdf
• http://files.boiseveteransdayparade.org/uploads/1/3/0/7/130776260/5079404.pdf
• http://files.centralvetimaging.com/uploads/1/3/0/7/130738596/576251.pdf
• http://kanowuge.watersideiv.org/uploads/1/3/2/6/132682883/gevolagupakena-kodokelabesikuv-kitaf.pdf
• https://88295aa3-17f5-4303-8b5f-ebe614374256.filesusr.com/ugd/6f7357_b02ca4589fe44c0baf2a2e52c8a59998.pdf?index=true
• https://728fe141-3ee7-4b48-9baa-1e007c238a56.filesusr.com/ugd/db93e9_0fb32e10e8034e44b7c37f0b78f2c4ec.pdf?index=true
• https://ee7d70c6-29cc-4bcd-bacd-a86b8156c615.filesusr.com/ugd/23a6c3_0f405eefb120490c9ac5b0322d2fb275.pdf?index=true
• https://72048008-6c09-4281-9361-96519ba0225c.filesusr.com/ugd/3be48b_d68a6c0dbf7b4a58bcaacc1f8a008829.pdf?index=true
• https://acd880ec-4189-47f5-b293-78b3010ccd4a.filesusr.com/ugd/668a47_11a07ceb8b2140a68bf0bad8b2ec6b99.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• a482bb61-7124-4cbd-bb6c-a4fa8c818f89.filesusr.com
• 2d21c5d9-7c31-4b83-b5e8-33c914637e9a.filesusr.com
• 5d859b76-c6fc-44e5-b2f6-41f77ade5da9.filesusr.com
• 494d5c9c-3482-438d-8bf1-f9182e84b8fb.filesusr.com
• caca5d0c-9c6d-457b-83ac-08261fde043b.filesusr.com
• files.designedbyjpp.co.uk
• files.ericheerspinkceramics.com
• rilag.steadfastleaders.org
• dareweg.davidpapo.com
• files.boiseveteransdayparade.org
• files.centralvetimaging.com
• kanowuge.watersideiv.org
• 88295aa3-17f5-4303-8b5f-ebe614374256.filesusr.com
• 728fe141-3ee7-4b48-9baa-1e007c238a56.filesusr.com
• ee7d70c6-29cc-4bcd-bacd-a86b8156c615.filesusr.com
• 72048008-6c09-4281-9361-96519ba0225c.filesusr.com
• acd880ec-4189-47f5-b293-78b3010ccd4a.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report