MALICIOUS — 1b6cec_867752edb3ff4b49a650b958266e1544.pdf

MALICIOUS — 1b6cec_867752edb3ff4b49a650b958266e1544.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: a0338e50b081670163b99b2344b032a48080ecc088367b46286dddb643e0141a
SHA-1: 7affb881bfead1c9717a69a1cf55cd02334d7a74
MD5: 1bf3d7533bc794b4b4ab1ad3deefac6f
ssdeep: 768:ogGzpDQsNmtxVmyyYA8o9nzoRknBwDCXRdfSpSZ7AVJEHlOmC:lGFEsoToSR0WD6fSpSZ7YJEHlOmC
TLSH: T18432ADF3905BDD8CBA866B13AEA612195184D68D7233976155CCB67CC4BC3FC7E10822
Submitted as: 1b6cec_867752edb3ff4b49a650b958266e1544.pdf
File type: pdf · Size: 43343 bytes
Verdict: malicious (88/100)

Detections (3 of 53 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://ttraff.link/wix?keyword=sea+turtle+game, https://75e9bc4f-49fb-469e-9821-f4a6ac1676ec.filesusr.com/ugd/02631b_4204460349744e12ab553f118bb24270.pdf?index=true, https://7088578b-5afa-4b01-8a54-a600cf35e695.filesusr.com/ugd/9d869b_733e277af2d44b94ba6207594cc6c362.pdf?index=true - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://ttraff.link/wix?keyword=sea+turtle+game
https://75e9bc4f-49fb-469e-9821-f4a6ac1676ec.filesusr.com/ugd/02631b_4204460349744e12ab553f118bb24270.pdf?index=true
https://7088578b-5afa-4b01-8a54-a600cf35e695.filesusr.com/ugd/9d869b_733e277af2d44b94ba6207594cc6c362.pdf?index=true
https://428265a0-61fb-4e59-933e-59dd856b2709.filesusr.com/ugd/1e557c_18a5b2a3bf78466ca21d29a3bf668d0f.pdf?index=true
http://files.davidensleydesign.com/uploads/1/3/1/8/131856539/buvajivefu.pdf
http://waforerep.nurrd.com/uploads/1/3/0/7/130775883/3772014.pdf
http://kuxiro.miweddingpainter.com/uploads/1/3/2/8/132815806/7847985.pdf
http://files.bckmphnz.com/uploads/1/3/1/8/131856706/5735170.pdf
http://refajilo.houseofgeekiness.com/uploads/1/3/2/3/132303382/963fa.pdf
http://files.heidiloveshymns.com/uploads/1/3/2/8/132814898/4928824.pdf
http://fixiko.lifebalanceyoga.net/uploads/1/3/1/4/131453284/5609936.pdf
https://c26c580a-9433-42a5-9112-ab2dc8e3f5d5.filesusr.com/ugd/e3325f_854c61e38fb04063a05ea76f1ad11577.pdf?index=true
https://10ce5b73-14cb-444f-b34a-761785de69b9.filesusr.com/ugd/a8ca0f_02d9ee1cea18436a93d59cb43bafe523.pdf?index=true
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/rights/

Embedded domains

ttraff.link
75e9bc4f-49fb-469e-9821-f4a6ac1676ec.filesusr.com
7088578b-5afa-4b01-8a54-a600cf35e695.filesusr.com
428265a0-61fb-4e59-933e-59dd856b2709.filesusr.com
files.davidensleydesign.com
waforerep.nurrd.com
kuxiro.miweddingpainter.com
files.bckmphnz.com
refajilo.houseofgeekiness.com
files.heidiloveshymns.com
fixiko.lifebalanceyoga.net
c26c580a-9433-42a5-9112-ab2dc8e3f5d5.filesusr.com
10ce5b73-14cb-444f-b34a-761785de69b9.filesusr.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report