MALICIOUS — 2994dd_93a104e0b6da43428e445225d401fef3.pdf

MALICIOUS — 2994dd_93a104e0b6da43428e445225d401fef3.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 8a254bc4dc108c818ebae72a503a6ba7416b636847b34e226983612f2515dde6
• SHA-1: 6d9891bd6d05a4a9f3fbfdd1ad666d01a7791c39
• MD5: 91c7af7c2db1d51c22eca0fd2833136e
• ssdeep: 1536:/GFliOTdxjgdPJ8BUV+3XY00HjBkvw3BJFvy:uFl9gdRvG2DevI7k
• TLSH: T14D33BEF3106BFC8D7A4A6B03EDAB0059654BC7C95137BA9008CD762CD2786FD6E10962
• Submitted as: 2994dd_93a104e0b6da43428e445225d401fef3.pdf
• File type: pdf · Size: 50489 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=darth+vader+%25231+pdf, https://cdn.shopify.com/s/files/1/0432/6090/3582/files/domolaxalixofofa.pdf, https://cdn.shopify.com/s/files/1/0429/2401/5783/files/boondocks_comic.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=darth+vader+%25231+pdf
• https://cdn.shopify.com/s/files/1/0432/6090/3582/files/domolaxalixofofa.pdf
• https://cdn.shopify.com/s/files/1/0429/2401/5783/files/boondocks_comic.pdf
• https://cdn.shopify.com/s/files/1/0461/4068/6489/files/abm_investama_sustainability_report.pdf
• https://cdn.shopify.com/s/files/1/0432/2990/5058/files/libev.pdf
• https://cdn.shopify.com/s/files/1/0432/5657/8212/files/40204749512.pdf
• https://cdn.shopify.com/s/files/1/0429/8312/9251/files/warlock_classic_guide.pdf
• https://cdn.shopify.com/s/files/1/0436/4396/1494/files/39627711717.pdf
• https://cdn.shopify.com/s/files/1/0466/7873/7061/files/ragnarok_m_eternal_love_leveling_guide_swordsman.pdf
• https://cdn.shopify.com/s/files/1/0440/6899/5222/files/rulomosiwivilolitum.pdf
• https://cdn.shopify.com/s/files/1/0436/9527/6187/files/likawapusib.pdf
• http://files.dunblanebowlingclub.org.uk/uploads/1/3/1/3/131381614/b44f734313a60.pdf
• http://letugudag.valleyfire.us/uploads/1/3/2/6/132682883/biletogizonemabaju.pdf
• http://files.pelsonfamily.com/uploads/1/3/1/3/131384414/zozep-lofimejetoki-muzasawalub.pdf
• http://sabetipef.yaph-studio.com/uploads/1/3/2/6/132696483/af221002277b41.pdf
• https://cdn.shopify.com/s/files/1/0434/8379/1517/files/nipemotebezipukewurugu.pdf
• https://cdn.shopify.com/s/files/1/0447/9811/6006/files/resonance_circuit_lab_report.pdf
• https://cdn.shopify.com/s/files/1/0448/0968/3106/files/9937565770.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• cdn.shopify.com
• files.dunblanebowlingclub.org.uk
• letugudag.valleyfire.us
• files.pelsonfamily.com
• sabetipef.yaph-studio.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report