MALICIOUS — 2f7489_51b6c53a6c884835a0f16dc473c3490c.pdf

MALICIOUS — 2f7489_51b6c53a6c884835a0f16dc473c3490c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 99b4034a2fb4037e5f0d26c327423b9b2eb58ad090a51ce2915a544efaa06d7d
• SHA-1: e3b9ab2374de9a71a126eb44d46d044238363f1e
• MD5: 0f071145e57c837ed3efaab74ac78216
• ssdeep: 768:igGzpDSm3lmSuR3tXQiz6qdu8AXDMRZGz96sGC15Pa:/GFfcl6L8qka9gk5Pa
• TLSH: T12531AEF36097ED8C3A476F43AAAA0568604AC78D3273979065C9766CC0BC6FC6F04961
• Submitted as: 2f7489_51b6c53a6c884835a0f16dc473c3490c.pdf
• File type: pdf · Size: 41657 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=sonido+de+grillos+en+los+oidos, http://files.jjartmedia.com/uploads/1/3/0/8/130815014/fc38c8ee1f562dd.pdf, http://files.clubomegatree.com/uploads/1/3/2/7/132740547/3350960.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=sonido+de+grillos+en+los+oidos
• http://files.jjartmedia.com/uploads/1/3/0/8/130815014/fc38c8ee1f562dd.pdf
• http://files.clubomegatree.com/uploads/1/3/2/7/132740547/3350960.pdf
• http://files.katiebeaneyoga.com/uploads/1/3/2/6/132681488/7a020a43b66.pdf
• http://files.psmk.ca/uploads/1/3/1/3/131379268/049dc33.pdf
• http://files.ryankitley.com/uploads/1/3/2/6/132695663/9672795.pdf
• http://fivugugu.angelaherbert-hodges.com/uploads/1/3/2/7/132740763/1775cf58f.pdf
• http://files.dahammaak2k.com/uploads/1/3/0/8/130814393/molabaju-mapusa-fexufegojuvome-katobesipu.pdf
• http://files.airstreamroadtrips.com/uploads/1/3/2/6/132681698/5f61d8540e359.pdf
• https://cdn.shopify.com/s/files/1/0431/3051/9709/files/jafawekaxafidapifupafafo.pdf
• https://cdn.shopify.com/s/files/1/0449/4861/9419/files/margaret_atwood_the_testaments_free.pdf
• https://cdn.shopify.com/s/files/1/0454/3918/9142/files/transformers_all_combiners.pdf
• https://cdn.shopify.com/s/files/1/0434/5774/0957/files/85034506980.pdf
• https://cdn.shopify.com/s/files/1/0431/6761/3087/files/lullaby_of_birdland_ukulele.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• files.jjartmedia.com
• files.clubomegatree.com
• files.katiebeaneyoga.com
• files.psmk.ca
• files.ryankitley.com
• fivugugu.angelaherbert-hodges.com
• files.dahammaak2k.com
• files.airstreamroadtrips.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report