MALICIOUS — 6c032c_114d470773f245d0bf94d560052c90ba.pdf

MALICIOUS — 6c032c_114d470773f245d0bf94d560052c90ba.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 9fb3d6c45f4988796248b841d7ddb9d2165db1a37dc0c92fbfbe85d65581ffc4
• SHA-1: 2793ec826800e6bbc77e371eecfd88cbb044dd74
• MD5: 20de771ece42366dc59c3dc54f6416ea
• ssdeep: 768:CjgGzpDlTHNir5Me/R8HbmS9kXmevbfM6k9E4t1kgznF2oQH6y7h:5GFJu7RGmS9kWez06k9H3hF2oQH6y7h
• TLSH: T100329EF350A7DD8C3ACB9B13ADEA1599648AD688603B967005D8772CD47C3FC6E01B60
• Submitted as: 6c032c_114d470773f245d0bf94d560052c90ba.pdf
• File type: pdf · Size: 46933 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=texas+dealer+manual+2018, http://files.vineyardranchpta.org/uploads/1/3/1/4/131438538/volijajojo-naninedomolevum.pdf, http://sewexi.soundscapemusic.net/uploads/1/3/1/4/131437421/939386f3f53c6b.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=texas+dealer+manual+2018
• http://files.vineyardranchpta.org/uploads/1/3/1/4/131438538/volijajojo-naninedomolevum.pdf
• http://sewexi.soundscapemusic.net/uploads/1/3/1/4/131437421/939386f3f53c6b.pdf
• http://papil.uwcspar.org/uploads/1/3/0/9/130969744/nejibebebuxedenavu.pdf
• http://files.kahinaasurah.com/uploads/1/3/2/7/132740204/5d7abfa8.pdf
• http://lovogur.knoestudios.com/uploads/1/3/2/6/132681862/sukewumaja_sapotebofed_tanimidigogape.pdf
• http://files.sunlandservice.com/uploads/1/3/0/7/130740069/af6db4d.pdf
• http://jozupam.crrcinc.org/uploads/1/3/1/4/131454215/tuzem-vaseviv-zawezok-bokikugetoz.pdf
• http://files.valleygraceevents.net/uploads/1/3/2/8/132814343/f936bdad3e9d803.pdf
• http://wakevu.stchristopherswooster.org/uploads/1/3/0/7/130775997/1f543e8cc2a53c.pdf
• https://823440e5-5c97-429a-ae74-10f964c195a0.filesusr.com/ugd/c8df25_90a0f20866ac4882b3e26d8bf8ca60c9.pdf?index=true
• https://1476a1ba-32a6-4fa0-a24f-5009a7ddecd9.filesusr.com/ugd/eb4c03_f91803a802b74aca8bf880fda5107c8b.pdf?index=true
• https://7a6faf4c-94ad-4a2f-b835-a388c8e8baae.filesusr.com/ugd/11b39a_c7d180612f42412481127961ddeac07e.pdf?index=true
• https://5b2775f3-93cb-4d05-9f16-2a29aa12ba4f.filesusr.com/ugd/6e2da7_dfe542e117404d0394b2f2df014709f9.pdf?index=true
• https://a51992b9-f126-465f-8d2e-915d33a20b77.filesusr.com/ugd/7d1dc9_2f28f09c78e14ee9bc9d1687a7378a4c.pdf?index=true
• https://6b66dab3-777e-4ef7-917b-daeb19ba796b.filesusr.com/ugd/99965f_0f75afda03bd4a9281d9d785375d35b0.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• files.vineyardranchpta.org
• sewexi.soundscapemusic.net
• papil.uwcspar.org
• files.kahinaasurah.com
• lovogur.knoestudios.com
• files.sunlandservice.com
• jozupam.crrcinc.org
• files.valleygraceevents.net
• wakevu.stchristopherswooster.org
• 823440e5-5c97-429a-ae74-10f964c195a0.filesusr.com
• 1476a1ba-32a6-4fa0-a24f-5009a7ddecd9.filesusr.com
• 7a6faf4c-94ad-4a2f-b835-a388c8e8baae.filesusr.com
• 5b2775f3-93cb-4d05-9f16-2a29aa12ba4f.filesusr.com
• a51992b9-f126-465f-8d2e-915d33a20b77.filesusr.com
• 6b66dab3-777e-4ef7-917b-daeb19ba796b.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report