MALICIOUS — 26d99b9ad7f.pdf

MALICIOUS — 26d99b9ad7f.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100). 3 of 50 detection engines flagged it.

Identification

• SHA-256: 94723c362d7e81e8d4a8f002f5202474f1bcc51f4a335b15bb107e120d7948b3
• SHA-1: c4edc93d4e193cbf335a8050924c507cb3252cb5
• MD5: 8c581d63b16c56b0ecf3af6a3dc74fae
• ssdeep: 1536:HGFrlod6lQmxg3FtvrARtVHapySEefTAF21:mFrOda7i3TkTVHalrTAe
• TLSH: T15635CFF314A7DD8C3A5ADF53AEAA106E6049D78C3233952045C8BA6CC8B85FE6F44461
• Submitted as: 26d99b9ad7f.pdf
• File type: pdf · Size: 63259 bytes
• Verdict: malicious (70/100)

Detections (3 of 50 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 70/100 is the fusion of 4 weighted signals:

• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: https://cctraff.ru/wb?keyword=episteme%20foucault%20pdf, https://uploads.strikinglycdn.com/files/b4ece785-0697-4ac4-a2e7-3dc4eea43fec/vinanudujef.pdf, https://cdn.shopify.com/s/files/1/0496/0855/6708/files/picsart_all_unlock_apk.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://cctraff.ru/wb?keyword=episteme%20foucault%20pdf
• https://uploads.strikinglycdn.com/files/b4ece785-0697-4ac4-a2e7-3dc4eea43fec/vinanudujef.pdf
• https://s3.amazonaws.com/falevi/gmod_prop_hunt_apk_download.pdf
• https://cdn.shopify.com/s/files/1/0496/0855/6708/files/picsart_all_unlock_apk.pdf
• https://uploads.strikinglycdn.com/files/2527b260-c4c8-4a0c-8b91-342f164a8c16/muxazutapediwit.pdf
• https://cdn-cms.f-static.net/uploads/4393358/normal_5f98c269f22e1.pdf
• https://cdn-cms.f-static.net/uploads/4369316/normal_5f96823cbad2c.pdf
• https://s3.amazonaws.com/mubefula/nikoxododimoperuto.pdf
• https://uploads.strikinglycdn.com/files/6d13eaa4-9958-4c85-9937-7d3f7dd82afd/31421419004.pdf
• https://vikumeniwexawud.weebly.com/uploads/1/3/0/9/130969440/72447a611f8.pdf
• https://cdn.shopify.com/s/files/1/0496/7661/5833/files/fiddler_on_the_roof_character_list.pdf
• https://uploads.strikinglycdn.com/files/c2796955-9a10-4a03-8e36-5a1ec9122d15/physioex_9.0_exercise_4_activity_4_answers.pdf
• https://uploads.strikinglycdn.com/files/703fbb02-51c3-4c57-8cd6-38e6c495a438/panenapote.pdf
• https://s3.amazonaws.com/tesodagiwor/sosupokobulogejupubu.pdf
• https://s3.amazonaws.com/wonoti/36937325521.pdf
• https://xazapadikud.weebly.com/uploads/1/3/1/8/131871762/6354a95404982a7.pdf
• https://uploads.strikinglycdn.com/files/7abb5d53-10f3-4ced-8886-00a057a4cdbc/tim_mcgraw_highway_dont_care_mp3_download.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• cctraff.ru
• uploads.strikinglycdn.com
• s3.amazonaws.com
• cdn.shopify.com
• cdn-cms.f-static.net
• vikumeniwexawud.weebly.com
• xazapadikud.weebly.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report