MALICIOUS — e54fc7_37e2431f703e4c43a244fef02f4f67eb.pdf

MALICIOUS — e54fc7_37e2431f703e4c43a244fef02f4f67eb.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 9075509e1c4d7d7aeab6422daa451cd6331a7af5c1d088453f733c45e68b469d
• SHA-1: b2f1f6459192200d297f1936346f985e642418cd
• MD5: 7cab42a6476203ef91280d39b467587f
• ssdeep: 3072:STF8lz237YjJlq9q8C19bUER1oI3EuWAc6UsZyeKW:+Qz2370JgnCnRR1p3EupnBKW
• TLSH: T18F3DF1F7601BDC8876DA8F57AAC76044704992C47532F2A055D9B5BCC4BC2ACEF61CA0
• Submitted as: e54fc7_37e2431f703e4c43a244fef02f4f67eb.pdf
• File type: pdf · Size: 124971 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): UDS:Trojan.PDF.SBadur.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.PDF.SBadur.gen (rule UDS:Trojan.PDF.SBadur.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.com/wix?keyword=booz+allen+field+guide+to+data+science+pdf, http://files.jchambersconstruction.com/uploads/1/3/1/0/131071256/1ea2e0623.pdf, http://files.lifeloveparenting.com/uploads/1/3/1/4/131453713/relonexudolalu.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.com/wix?keyword=booz+allen+field+guide+to+data+science+pdf
• http://files.jchambersconstruction.com/uploads/1/3/1/0/131071256/1ea2e0623.pdf
• http://files.lifeloveparenting.com/uploads/1/3/1/4/131453713/relonexudolalu.pdf
• http://files.smallthingsmarket.com/uploads/1/3/1/0/131071114/tuwejelukitimo-xatisubimuw-suwosixil.pdf
• http://files.rivershillcoc.org/uploads/1/3/0/9/130969614/pibetun.pdf
• https://34fe6227-863f-48f6-b70e-4ff1cf5c4e86.filesusr.com/ugd/dc8a8e_ff679102bc7046daa318286696a95318.pdf?index=true
• https://1fe830ce-749b-492d-b54a-0f7a22eb41ba.filesusr.com/ugd/9e14ca_a2e5915f068f4488be17e18bfcebd60f.pdf?index=true
• https://47e2edd4-bf0d-46db-9ef7-d1dc8924cc7d.filesusr.com/ugd/57c819_3e54b8ecb14e4dc28fae11b5c6bdc9b4.pdf?index=true
• https://522e8174-0a82-49d7-aca3-9d5423646b6e.filesusr.com/ugd/60ffa2_cdf8f9fb01c14dd8907baff7883a817c.pdf?index=true
• https://df6b0079-ba05-436e-a211-ae890a0f2335.filesusr.com/ugd/dfb5f8_f45422fbb67046f6b49ce6c7fd1d17c1.pdf?index=true
• https://2dae65b9-088c-4c56-a23e-fe511f2efcf9.filesusr.com/ugd/154db6_6964657b826d40709f689bd1679caf39.pdf?index=true
• https://dbfe5f5c-f6e5-4236-8a9f-6dc17ba6af37.filesusr.com/ugd/80bfa9_b2b519894e3c4755b02a9639df5b19a2.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.com
• files.jchambersconstruction.com
• files.lifeloveparenting.com
• files.smallthingsmarket.com
• files.rivershillcoc.org
• 34fe6227-863f-48f6-b70e-4ff1cf5c4e86.filesusr.com
• 1fe830ce-749b-492d-b54a-0f7a22eb41ba.filesusr.com
• 47e2edd4-bf0d-46db-9ef7-d1dc8924cc7d.filesusr.com
• 522e8174-0a82-49d7-aca3-9d5423646b6e.filesusr.com
• df6b0079-ba05-436e-a211-ae890a0f2335.filesusr.com
• 2dae65b9-088c-4c56-a23e-fe511f2efcf9.filesusr.com
• dbfe5f5c-f6e5-4236-8a9f-6dc17ba6af37.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report