MALICIOUS — f1780b_ba216325339041b2b9e30c5155034983.pdf

MALICIOUS — f1780b_ba216325339041b2b9e30c5155034983.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 9fad91026b1c78d8a012657a4654115ff6bea180705c58dc25f22c8ff318ed99
• SHA-1: b05d578ff7ee6f1e48d0b2cefc56a5f542c5f655
• MD5: eb85a7486ff5b9b01a3cbd1a440d91b4
• ssdeep: 768:KgGzpDm2ZBfQiTWHk9YPiOAiPnTgPWCL7bMAsU1lMvvYQkrf:XGFaJH5PTdPuYwMvvYQkrf
• TLSH: T1B833AFF355E7DD8C76835B435E6B1059918ACA896226A36058DC3B7CE47C2FEAF40830
• Submitted as: f1780b_ba216325339041b2b9e30c5155034983.pdf
• File type: pdf · Size: 48484 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=the+true+flag+book+by+steve+jobs+daughter, http://files.rosielonsdalephotography.co.uk/uploads/1/3/2/7/132712306/6929930.pdf, http://files.theathinai.com/uploads/1/3/0/9/130970016/povexuguf.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=the+true+flag+book+by+steve+jobs+daughter
• http://files.rosielonsdalephotography.co.uk/uploads/1/3/2/7/132712306/6929930.pdf
• http://files.theathinai.com/uploads/1/3/0/9/130970016/povexuguf.pdf
• http://files.theelephantstudio.com/uploads/1/3/1/6/131606275/medimuma.pdf
• http://files.campdogginit.com/uploads/1/3/0/9/130969053/57776fc6be.pdf
• http://files.magillcontracting.com/uploads/1/3/2/3/132303001/3516241.pdf
• http://tesuzodu.accipitercycles.com/uploads/1/3/0/7/130738946/8297885.pdf
• https://f6c366fc-f807-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/d775a9_904bc3f8fc494568b564d372cb15ead6.pdf?index=true
• https://de5a3d3a-8d40-47b0-adcb-ca7c6f02f93c.filesusr.com/ugd/1c44ce_aeedf3d3e3d046319cc60cc986e3afb5.pdf?index=true
• https://db58a6a0-6ff4-499d-80ec-dea5386fbbff.filesusr.com/ugd/3225da_9ae6e92044654c36ab2395bd1f33855c.pdf?index=true
• https://32dad5d5-d0f3-4db0-8d09-203847dc3fd1.filesusr.com/ugd/682d1c_44c055d5481649879e40037c24cf6aee.pdf?index=true
• https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true
• https://37cd0a03-e4c6-4b86-9322-43ff1f1f42bc.filesusr.com/ugd/610d21_3b4347a0118a4a07a8b9cfba13a6af45.pdf?index=true
• https://7e9558fa-cefe-448f-a025-c4882f245f24.filesusr.com/ugd/58a813_6ef808996dbb4d4fb5f2a0d99d374b67.pdf?index=true
• https://1827b85c-b2dd-459f-b7b4-68c54900d218.filesusr.com/ugd/dcc11b_dce5625eb2144b3f9551015fa2676ad5.pdf?index=true
• https://00f72ef0-907d-4a69-95d0-2f175d0c377e.filesusr.com/ugd/a91264_14cf0d1e2f5640c1b669b4658cdd52f7.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• files.rosielonsdalephotography.co.uk
• files.theathinai.com
• files.theelephantstudio.com
• files.campdogginit.com
• files.magillcontracting.com
• tesuzodu.accipitercycles.com
• f6c366fc-f807-11ea-a328-fc4dd43d38a6.filesusr.com
• de5a3d3a-8d40-47b0-adcb-ca7c6f02f93c.filesusr.com
• db58a6a0-6ff4-499d-80ec-dea5386fbbff.filesusr.com
• 32dad5d5-d0f3-4db0-8d09-203847dc3fd1.filesusr.com
• 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
• 37cd0a03-e4c6-4b86-9322-43ff1f1f42bc.filesusr.com
• 7e9558fa-cefe-448f-a025-c4882f245f24.filesusr.com
• 1827b85c-b2dd-459f-b7b4-68c54900d218.filesusr.com
• 00f72ef0-907d-4a69-95d0-2f175d0c377e.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report