MALICIOUS — 062c90_b018384e95794f5e99fbaa7e9c7b3a66.pdf

MALICIOUS — 062c90_b018384e95794f5e99fbaa7e9c7b3a66.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 9a2d5cad060923185f73c5eb38b23e283bd00eac3a527490e6791da8b96009c2
• SHA-1: 910cd95b079216f5a8cfdaa566765019c221a1df
• MD5: 645254259820f2aa8c8048bb45d37654
• ssdeep: 768:pgGzpDoNP8nAGY/G/lscGWj2+FxKX/d2OGz3OLI2M7UqlEZE0:KGFMN0nACNFA/DPI2M7LlEZE0
• TLSH: T17531AEF35097EDCC6E869B03ADBA015C2085C68DB037E66098D8376CC47C6FD6E41A61
• Submitted as: 062c90_b018384e95794f5e99fbaa7e9c7b3a66.pdf
• File type: pdf · Size: 41434 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=persian+chat+room+sweden, https://609bb223-f075-457b-bdae-c881ab12b8bf.filesusr.com/ugd/d2cc1f_8435671658354aa3a937939f82a3e127.pdf?index=true, https://5ae92456-e5f2-40cf-bfe2-6244b1d392fb.filesusr.com/ugd/8508de_2d84bf45200441adb08b113e393312b8.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=persian+chat+room+sweden
• https://609bb223-f075-457b-bdae-c881ab12b8bf.filesusr.com/ugd/d2cc1f_8435671658354aa3a937939f82a3e127.pdf?index=true
• https://5ae92456-e5f2-40cf-bfe2-6244b1d392fb.filesusr.com/ugd/8508de_2d84bf45200441adb08b113e393312b8.pdf?index=true
• https://ceb5b5a1-9825-4aae-860a-2ecd976478be.filesusr.com/ugd/d43733_be733a80749449f3a5ccb219030ba6ae.pdf?index=true
• https://65fc4afb-02ad-4235-9607-18f8ee1d727a.filesusr.com/ugd/217b8a_c42818ac611845d0a7dec430c25baf4e.pdf?index=true
• https://70b615b2-bada-4c17-ac76-e83238b4d00f.filesusr.com/ugd/b916f4_020c3e218c104cc98eea50403990068b.pdf?index=true
• http://files.aiselementary.com/uploads/1/3/2/7/132740408/winaxipigogiwi-rudemul-welolafabin-jafuzifepifun.pdf
• http://files.rshroff.com/uploads/1/3/1/4/131438718/borigixix-jelewari-kexerosipejetiv-moduviwixotuwur.pdf
• http://files.hertscammed.com/uploads/1/3/1/4/131437657/8444915.pdf
• http://files.reedsburgambulance.com/uploads/1/3/1/6/131606630/fe76bf2.pdf
• http://tirodo.eatbugsevents.com/uploads/1/3/1/3/131398428/9042c697df07f8.pdf
• https://cdn.shopify.com/s/files/1/0427/6148/6503/files/gisijoxevamegoruk.pdf
• https://cdn.shopify.com/s/files/1/0462/4767/4007/files/best_civilization_style_game_for_android.pdf
• https://cdn.shopify.com/s/files/1/0431/5113/0785/files/xokaxujokuveb.pdf
• https://cdn.shopify.com/s/files/1/0430/9811/2167/files/vulujodefabogozataki.pdf
• https://cdn.shopify.com/s/files/1/0430/4456/9242/files/summertime_saga_magazines.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• 609bb223-f075-457b-bdae-c881ab12b8bf.filesusr.com
• 5ae92456-e5f2-40cf-bfe2-6244b1d392fb.filesusr.com
• ceb5b5a1-9825-4aae-860a-2ecd976478be.filesusr.com
• 65fc4afb-02ad-4235-9607-18f8ee1d727a.filesusr.com
• 70b615b2-bada-4c17-ac76-e83238b4d00f.filesusr.com
• files.aiselementary.com
• files.rshroff.com
• files.hertscammed.com
• files.reedsburgambulance.com
• tirodo.eatbugsevents.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report