MALICIOUS — d93890_ed7560aec57e4950a4e5ac7da5395200.pdf

MALICIOUS — d93890_ed7560aec57e4950a4e5ac7da5395200.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 54 detection engines flagged it.

Identification

• SHA-256: 8bdf3b7b53c8f856982ebba126435bebf05b42eedecc72fe407cb31fe26d7b49
• SHA-1: 911bbe48e82dfe6cc3249c10ce92f85841507bd0
• MD5: c39cc22b4c4e311695bc1aaf066b8ad0
• ssdeep: 768:YbgGzpD4VryTBuUTCCe/6LjiSi9LrK9Ex62Q/DYyqtJdYEsvRJs43Vfgutvl37iQ:vGF0Vryr+Cm6LjS9v62Q/syqtPSRJfBX
• TLSH: T1CD33BEF30197ED8C7B9B9F4369B925089086EB8C2133AAA055D8BF6CC47C6ED1E10560
• Submitted as: d93890_ed7560aec57e4950a4e5ac7da5395200.pdf
• File type: pdf · Size: 48064 bytes
• Verdict: malicious (88/100)

Detections (3 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=2020+college+scholarship+deadlines, https://be332d63-7d1b-4aad-96ca-eadd7d8dfcf6.filesusr.com/ugd/565485_a78a0ebcb0814f4c88e4b31cccf60b99.pdf?index=true, https://b5710945-2cfb-413f-95d3-1bbc9a6780d2.filesusr.com/ugd/e948c1_dae740214fad429a88724b98eadce505.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=2020+college+scholarship+deadlines
• https://be332d63-7d1b-4aad-96ca-eadd7d8dfcf6.filesusr.com/ugd/565485_a78a0ebcb0814f4c88e4b31cccf60b99.pdf?index=true
• https://b5710945-2cfb-413f-95d3-1bbc9a6780d2.filesusr.com/ugd/e948c1_dae740214fad429a88724b98eadce505.pdf?index=true
• https://6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com/ugd/35c6e2_2059b52814764830a4fa6d03ab5a600d.pdf?index=true
• https://25d331cc-7e16-48f4-8bd8-f420c2b08791.filesusr.com/ugd/5ea691_4bd264bac7ed4adf837f5e489ccdfeaf.pdf?index=true
• http://files.lesleyyx1.com/uploads/1/3/1/6/131606368/feboten_naruruzefemiz_potukalanife_mitaxofesaze.pdf
• http://files.minutiamuse.com/uploads/1/3/0/9/130969209/suwikororotop.pdf
• http://files.vhca.info/uploads/1/3/1/6/131636642/9938549.pdf
• http://wuzor.lilianholm.com/uploads/1/3/1/3/131381045/8421934.pdf
• http://pusor.golfclashusa.com/uploads/1/3/1/4/131454766/wopezet_mexufira_matokemizawuxit_jovenebugozu.pdf
• https://7cafc753-a07f-4ef4-bb01-57954e861741.filesusr.com/ugd/9ea91e_ea8de22fe51d43deae39e36f28cab9b9.pdf?index=true
• https://da35df40-0a34-41aa-a9a0-f32accea0264.filesusr.com/ugd/e948c1_a656d9a9fd6241d686f707870b42d861.pdf?index=true
• https://9648fff0-1a56-4144-894d-9434265d309b.filesusr.com/ugd/3283b0_474222f61194499398711afa5d1bb15f.pdf?index=true
• https://94b3b21d-14ee-4d2b-a80f-d993f6e6c342.filesusr.com/ugd/8bf3fc_30acbcf13065495898cd4174eed0d719.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• be332d63-7d1b-4aad-96ca-eadd7d8dfcf6.filesusr.com
• b5710945-2cfb-413f-95d3-1bbc9a6780d2.filesusr.com
• 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com
• 25d331cc-7e16-48f4-8bd8-f420c2b08791.filesusr.com
• files.lesleyyx1.com
• files.minutiamuse.com
• files.vhca.info
• wuzor.lilianholm.com
• pusor.golfclashusa.com
• 7cafc753-a07f-4ef4-bb01-57954e861741.filesusr.com
• da35df40-0a34-41aa-a9a0-f32accea0264.filesusr.com
• 9648fff0-1a56-4144-894d-9434265d309b.filesusr.com
• 94b3b21d-14ee-4d2b-a80f-d993f6e6c342.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report