MALICIOUS — 1be480_60c0471aa4a34fd1a9653edc439fdc47.pdf

MALICIOUS — 1be480_60c0471aa4a34fd1a9653edc439fdc47.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: a1fdceb3e43bc43260dd660f52ccc18296870e61bd8a6e94b57e9b2d54f44482
• SHA-1: fc7d9f24fe2fdc99502403745d0b4b7b21b6b870
• MD5: fe1ae03432a3b19f862bf83e6eab0c3b
• ssdeep: 768:QgGzpDGNqFgulzM1bt6Jy6Z93asaXkEejVNhbetZPo8:9GFqWo1MJVj3aj0EejVNletZPo8
• TLSH: T13A307DF350A7EC8C7ACA9F036EE6249DA189D6885132A76455D8773CC87C3BD7E40850
• Submitted as: 1be480_60c0471aa4a34fd1a9653edc439fdc47.pdf
• File type: pdf · Size: 37167 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.link/wix?keyword=mekong+cafe+lunch+menu, http://vofazufa.myrolllife.com/uploads/1/3/2/6/132682883/sujaj.pdf, http://files.breadandbuttertogo.com/uploads/1/3/1/8/131871439/2518929.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.link/wix?keyword=mekong+cafe+lunch+menu
• http://vofazufa.myrolllife.com/uploads/1/3/2/6/132682883/sujaj.pdf
• http://files.breadandbuttertogo.com/uploads/1/3/1/8/131871439/2518929.pdf
• http://files.dawnentertainment.net/uploads/1/3/1/3/131380052/lamulotut_gibujupinixexar_jeposaxifafeg.pdf
• http://wobax.roadslaves.com/uploads/1/3/0/9/130969723/sevipafobemino-welobajewitakob-zamarulonu-nopatojatojekuz.pdf
• http://jebowum.xenicdesign.com/uploads/1/3/1/4/131438617/sikili.pdf
• https://cdn.shopify.com/s/files/1/0482/4544/0666/files/kibapiwudetefa.pdf
• https://cdn.shopify.com/s/files/1/0437/1090/6520/files/65794728132.pdf
• https://cdn.shopify.com/s/files/1/0437/4278/9786/files/tibadufixaxirozagogis.pdf
• http://files.sexualintegrity247.com/uploads/1/3/1/4/131453950/teratusukipu.pdf
• http://nerumebuf.chanabarriger.com/uploads/1/3/2/6/132695832/2896155.pdf
• http://files.ask-noodles.com/uploads/1/3/1/4/131453919/ladonipufogo-gukuwamipaxinut-gofuz-najogogimifetiv.pdf
• http://files.restauranthibiscus.com/uploads/1/3/0/7/130776841/5106130.pdf
• http://files.cathedralmountainknifeworks.com/uploads/1/3/1/0/131070362/1319900.pdf
• https://df8300be-2428-4e35-a6fc-a3257544035c.filesusr.com/ugd/08338c_4349faab21d142d2bfa3b4e7da32fccf.pdf?index=true
• https://10ca1b36-379f-404a-9482-ae1fb0ab465d.filesusr.com/ugd/33ab24_026c5235e40946d5acb00829ccabedb5.pdf?index=true
• https://42dfe187-fe1a-4615-a7b1-b93154d03811.filesusr.com/ugd/5af86b_b999e4fc3f0e496fbc643adbadaf7027.pdf?index=true
• https://98e6a617-be7b-4871-aa30-b64b413a3a63.filesusr.com/ugd/529dbf_5d18de979ab042f78ab638480315181c.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.link
• vofazufa.myrolllife.com
• files.breadandbuttertogo.com
• files.dawnentertainment.net
• wobax.roadslaves.com
• jebowum.xenicdesign.com
• cdn.shopify.com
• files.sexualintegrity247.com
• nerumebuf.chanabarriger.com
• files.ask-noodles.com
• files.restauranthibiscus.com
• files.cathedralmountainknifeworks.com
• df8300be-2428-4e35-a6fc-a3257544035c.filesusr.com
• 10ca1b36-379f-404a-9482-ae1fb0ab465d.filesusr.com
• 42dfe187-fe1a-4615-a7b1-b93154d03811.filesusr.com
• 98e6a617-be7b-4871-aa30-b64b413a3a63.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report