MALICIOUS — 930050_de83b89bf340488293eb7f204c0f1142.pdf

MALICIOUS — 930050_de83b89bf340488293eb7f204c0f1142.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: a52b2d671d78514c01aded5800c48fed6a05f75cde5b9929a6f25d155c8e04be
• SHA-1: 51bd4890cdc87a082638821047a61bcaa9e1f576
• MD5: 932e2a579eda60de95436006a8f54d02
• ssdeep: 768:fgGzpDKLoE0nItxvqY1wsspTnZlR9S8Vxftwkq1YZsogHsPQXnlBgCET:oGFupuItxv0sxYftm1ssrH4QVBgFT
• TLSH: T19233AFF31097ED8C3A4BAF135DAA10496149E2896033A77455D83B6CC4BCBFD5D11A21
• Submitted as: 930050_de83b89bf340488293eb7f204c0f1142.pdf
• File type: pdf · Size: 47909 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=edmond+metropolitan+library+ebooks, https://8bc45baf-93f2-4ecd-8ef5-14ceacef1ee9.filesusr.com/ugd/07e02c_d22c28ea0fa542acaba3e5db7d38afd1.pdf?index=true, https://dec49060-e462-4eb9-9c0e-236277f9bd2d.filesusr.com/ugd/61c57f_5bbadeb049014e53b6d9096115f6f559.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=edmond+metropolitan+library+ebooks
• https://8bc45baf-93f2-4ecd-8ef5-14ceacef1ee9.filesusr.com/ugd/07e02c_d22c28ea0fa542acaba3e5db7d38afd1.pdf?index=true
• https://dec49060-e462-4eb9-9c0e-236277f9bd2d.filesusr.com/ugd/61c57f_5bbadeb049014e53b6d9096115f6f559.pdf?index=true
• https://c9018523-2d3b-4e2a-876c-e37f6b0aec35.filesusr.com/ugd/8a05ec_efe4085ad8da4503bd2f5fb55c9ff202.pdf?index=true
• https://b5946bcc-f728-4cd0-8bb7-bb7f2f27a05a.filesusr.com/ugd/f1780b_e719dad299784e44bb3d7729d28d4753.pdf?index=true
• https://74320dd4-877b-4071-b8c8-2ad1bc8ef582.filesusr.com/ugd/98e2de_3b8fa004c81f48b8a67de9abad40af84.pdf?index=true
• https://7e4df4e0-785e-4ccc-bdcc-04ff6bbdfaf8.filesusr.com/ugd/dfb5f8_fabfc595f94f499a846d8cd0f7f62a99.pdf?index=true
• https://cbb38882-d1be-42e9-b16c-64413cc28ae3.filesusr.com/ugd/81d6a4_c2c992ceab124610bfa85dd8dfaac708.pdf?index=true
• http://povuwidu.theletterkstore.com/uploads/1/3/2/6/132681337/2289834.pdf
• http://jijivof.luggagelockers.is/uploads/1/3/0/7/130738614/bamuxi.pdf
• http://puzege.phisigmapidavis.com/uploads/1/3/1/3/131379730/sujipijelenewurex.pdf
• https://654c680d-7028-4ef6-b939-33a0fd111886.filesusr.com/ugd/b58d21_66776b48b67f4720a26606bc7c732502.pdf?index=true
• https://100e3710-0fa1-41cb-ada9-bd15de84e0bb.filesusr.com/ugd/d38238_9bdf05ccbfc74d0cbdc6c14436c66f57.pdf?index=true
• https://5c28f5bd-e7e7-445a-8909-e02fda1222d5.filesusr.com/ugd/d7d6cd_8bfe35d3b8ac4b7e94ad61414bb8e74d.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 8bc45baf-93f2-4ecd-8ef5-14ceacef1ee9.filesusr.com
• dec49060-e462-4eb9-9c0e-236277f9bd2d.filesusr.com
• c9018523-2d3b-4e2a-876c-e37f6b0aec35.filesusr.com
• b5946bcc-f728-4cd0-8bb7-bb7f2f27a05a.filesusr.com
• 74320dd4-877b-4071-b8c8-2ad1bc8ef582.filesusr.com
• 7e4df4e0-785e-4ccc-bdcc-04ff6bbdfaf8.filesusr.com
• cbb38882-d1be-42e9-b16c-64413cc28ae3.filesusr.com
• povuwidu.theletterkstore.com
• puzege.phisigmapidavis.com
• 654c680d-7028-4ef6-b939-33a0fd111886.filesusr.com
• 100e3710-0fa1-41cb-ada9-bd15de84e0bb.filesusr.com
• 5c28f5bd-e7e7-445a-8909-e02fda1222d5.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com
• jijivof.luggagelockers.is

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report