MALICIOUS — 03f576_16e9858de8674e79a504a9eb57899109.pdf

MALICIOUS — 03f576_16e9858de8674e79a504a9eb57899109.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: 8de1657f7bbdd30ce8473a89786939ef59561a78b830130228722bae0182def3
SHA-1: ea1c5e8f347ca7163ab3073d17ead0a398143d41
MD5: 0bf755308d69919b84208941250ba961
ssdeep: 768:rgGzpD2O5mMgKekPiLxkrSXs/OSkviqblVC+lC3TCwBtFlpYJybT:UGFiOaNXedk6qp+3uwfFlMybT
TLSH: T17D32AEF3005BFD4D7BCDAF03AEA701596186D28D2137A66008987B6DC5BC6ED3E00A65
Submitted as: 03f576_16e9858de8674e79a504a9eb57899109.pdf
File type: pdf · Size: 43478 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.link/wix?keyword=track+and+field+quotes+for+instagram, https://41d38010-9445-4d4a-a840-158e9b92afc5.filesusr.com/ugd/544e7e_1190a5f4c2a342698a508a1713f2ec42.pdf?index=true, https://8f0813ee-8e07-46c8-b237-c1fc1e4b37a3.filesusr.com/ugd/417718_aedaad1cb2f44e16927b30afa8b0c116.pdf?index=true - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.link/wix?keyword=track+and+field+quotes+for+instagram
https://41d38010-9445-4d4a-a840-158e9b92afc5.filesusr.com/ugd/544e7e_1190a5f4c2a342698a508a1713f2ec42.pdf?index=true
https://8f0813ee-8e07-46c8-b237-c1fc1e4b37a3.filesusr.com/ugd/417718_aedaad1cb2f44e16927b30afa8b0c116.pdf?index=true
https://126f0b39-27a4-4ae8-891e-8276cdf0f939.filesusr.com/ugd/e3ed1f_e38300734ac744b4b46c0141e05b8507.pdf?index=true
https://d57e807e-80cb-49cb-b1df-585b5babf300.filesusr.com/ugd/8a9bcc_354f6090c2af4289a829c60fa16bc22a.pdf?index=true
http://josikefu.tandhathletics.com/uploads/1/3/0/8/130813528/6ce75371.pdf
http://files.eastcommltd.com/uploads/1/3/2/6/132681213/7116649.pdf
http://files.ijcmsr.com/uploads/1/3/0/7/130775952/kimen-lijiwujop-poxijugunoguz.pdf
https://cdn.shopify.com/s/files/1/0434/7727/0692/files/generador_citas_apa.pdf
https://cdn.shopify.com/s/files/1/0437/2499/6757/files/74184621992.pdf
https://cdn.shopify.com/s/files/1/0428/9059/2422/files/kufowi.pdf
https://cdn.shopify.com/s/files/1/0434/1507/7022/files/digazo.pdf
https://cdn.shopify.com/s/files/1/0435/8320/9631/files/gasobixu.pdf
https://cdn.shopify.com/s/files/1/0437/8217/6920/files/mijajofakajaxoxu.pdf
https://cdn.shopify.com/s/files/1/0439/5443/8302/files/fuvaxivimozodurapubapikaz.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.link
41d38010-9445-4d4a-a840-158e9b92afc5.filesusr.com
8f0813ee-8e07-46c8-b237-c1fc1e4b37a3.filesusr.com
126f0b39-27a4-4ae8-891e-8276cdf0f939.filesusr.com
d57e807e-80cb-49cb-b1df-585b5babf300.filesusr.com
josikefu.tandhathletics.com
files.eastcommltd.com
files.ijcmsr.com
cdn.shopify.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report