MALICIOUS — f99735_99f82e092570453f8e9093f3ceb87a2c.pdf

MALICIOUS — f99735_99f82e092570453f8e9093f3ceb87a2c.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: a5fa5da571f486cd8101da7ec1f310ec5479902f1abd0ab0be58148d54ab8cde
• SHA-1: 717970fadeacf1502782a0296db44034d3c91190
• MD5: 6686534bfd579958da41dd6cfba70cab
• ssdeep: 768:vgGzpDGSOC7WpOqn23Bb3CwMXpY9tbGFCCY6cGHNzXw:YGF6SUpD23BTCwO6GECY67NzXw
• TLSH: T1F832AEF35497ED8D6986AF439EE2046921A6C3882137D66018CC7A7CC47C7FCAD50972
• Submitted as: f99735_99f82e092570453f8e9093f3ceb87a2c.pdf
• File type: pdf · Size: 44683 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=gem+sound+gmw+61+dual+wireless+microphone+manual, http://files.ucblbsa.com/uploads/1/3/0/9/130969510/161434.pdf, http://files.vierajrotc.org/uploads/1/3/1/3/131379296/95883826a879e.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=gem+sound+gmw+61+dual+wireless+microphone+manual
• http://files.ucblbsa.com/uploads/1/3/0/9/130969510/161434.pdf
• http://files.vierajrotc.org/uploads/1/3/1/3/131379296/95883826a879e.pdf
• http://files.adventurerunningco.com/uploads/1/3/1/6/131606134/8036558.pdf
• http://files.thetismassage.com/uploads/1/3/1/3/131381332/pazuva.pdf
• http://vapafejiv.lunafiberartist.com/uploads/1/3/2/3/132303320/6834357.pdf
• http://files.virginiapopova.com/uploads/1/3/1/6/131637850/tofijapenomelim_bubik.pdf
• http://files.watson5th.com/uploads/1/3/1/4/131407965/rosoxiso-fufomu-kitaravakenin.pdf
• http://bobejun.lebanonproject.org/uploads/1/3/1/3/131380942/lewisugozovokisa.pdf
• http://mewis.t9corp.com/uploads/1/3/0/7/130775565/0c459.pdf
• http://files.safeexitsummit.org/uploads/1/3/0/7/130776661/4455332.pdf
• http://nagem.chaunceyrasmussen.com/uploads/1/3/1/4/131406263/netinagopu.pdf
• https://dea66520-d3a5-430b-b892-122f19b9e3ae.filesusr.com/ugd/384ea4_472a3b0799af4708b7b1afcdf1937112.pdf?index=true
• https://f3e0c5ea-d6b4-4288-af3d-57876f54281e.filesusr.com/ugd/dcf311_a2a94dcdc56c4cc1bf455e9bae1ed296.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• files.ucblbsa.com
• files.vierajrotc.org
• files.adventurerunningco.com
• files.thetismassage.com
• vapafejiv.lunafiberartist.com
• files.virginiapopova.com
• files.watson5th.com
• bobejun.lebanonproject.org
• mewis.t9corp.com
• files.safeexitsummit.org
• nagem.chaunceyrasmussen.com
• dea66520-d3a5-430b-b892-122f19b9e3ae.filesusr.com
• f3e0c5ea-d6b4-4288-af3d-57876f54281e.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report