MALICIOUS — 89064d_c8907618bc29488bb338a612d6dece99.pdf

MALICIOUS — 89064d_c8907618bc29488bb338a612d6dece99.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100). 4 of 53 detection engines flagged it.

Identification

• SHA-256: aa09655033537a22b85abb2508bea3cc5330275ce18a58db8688276f03696cec
• SHA-1: 0cf75e2b29ccd8b289a44e4c6c546dd491edc92b
• MD5: d4912cc4ff2151618931e018c043d56b
• ssdeep: 1536:EGFby+N/9sP2GZUlMszLbAectn6jwWflBAXtqsjSoRHDpH:RFbJEeFMobA/n602OtdWkH1
• TLSH: T1A537C0F35097DE8C799E9B57996A0454B09AD7C97023AB7019C9776C88783FCAF00A20
• Submitted as: 89064d_c8907618bc29488bb338a612d6dece99.pdf
• File type: pdf · Size: 71648 bytes
• Verdict: malicious (94/100)

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:PDF/Phish!atmn
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 94/100 is the fusion of 7 weighted signals:

• Microsoft Defender flagged Trojan:PDF/Phish!atmn (rule Trojan:PDF/Phish!atmn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=saint+seiya+awakening+guide+cosmo, https://5155192b-3def-4987-9bb5-59ec1b359be5.filesusr.com/ugd/610d21_cf15904322114f04ae5da6ddca60aa8a.pdf?index=true, https://06f0fce1-1a69-43a1-aa63-c77d09e183fa.filesusr.com/ugd/3be48b_49e906e013424477b095d07e716390df.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=saint+seiya+awakening+guide+cosmo
• https://5155192b-3def-4987-9bb5-59ec1b359be5.filesusr.com/ugd/610d21_cf15904322114f04ae5da6ddca60aa8a.pdf?index=true
• https://06f0fce1-1a69-43a1-aa63-c77d09e183fa.filesusr.com/ugd/3be48b_49e906e013424477b095d07e716390df.pdf?index=true
• https://b220e211-7334-4852-a8ab-5c67d0fa89aa.filesusr.com/ugd/565485_232b2daa8a3e48aca9a952c9010a60ee.pdf?index=true
• https://75d7c3e4-dfa8-4198-aa6f-b23fd97d1a17.filesusr.com/ugd/035627_27f4d024be634b429ac060a83b78b05a.pdf?index=true
• https://5959f75f-ce17-405c-971a-94e16ddb9b77.filesusr.com/ugd/2994dd_ce5cce2586dd462e8528a14166b0cbb4.pdf?index=true
• https://c20604e6-355e-4a9a-9367-a631e79b6230.filesusr.com/ugd/89602e_6af73bcb3d33414ba34a4b8f1b99ad6d.pdf?index=true
• https://22d4760d-0511-4e42-a791-fdff23529de6.filesusr.com/ugd/035627_7ce75505a5b14889a45632d0461b0330.pdf?index=true
• https://1ef64aaf-114e-41dd-9822-71e92ba46f13.filesusr.com/ugd/035627_c19c9c78b8524fa48c607185abee6824.pdf?index=true
• http://files.hannahsclassroom.com/uploads/1/3/1/6/131606758/jeriv.pdf
• http://bizobap.ckuniquedesigns.com/uploads/1/3/2/6/132682051/57cb84b832873.pdf
• https://054bb1ca-f808-11ea-a328-fc4dd43d38a6.filesusr.com/ugd/d775a9_bb362e18c25343068c6d1d54df956a04.pdf?index=true
• https://8c436923-5f12-463f-a08e-2b2a6cb99ebe.filesusr.com/ugd/3f80ec_4e739a9c87e84c06b8d2101f49a93052.pdf?index=true
• https://9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com/ugd/dcf311_bfbd33e20a804fa09b269749c2a18b2e.pdf?index=true
• https://717c7084-f980-4879-ae32-067e94814490.filesusr.com/ugd/3be48b_ddc8a5e628ec42faaf0eddcb9133da4a.pdf?index=true
• https://3d8d954d-e23b-4049-a597-531d0ba7570a.filesusr.com/ugd/7be1cd_6922391ec714455ca7bd922ceab97f5a.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 5155192b-3def-4987-9bb5-59ec1b359be5.filesusr.com
• 06f0fce1-1a69-43a1-aa63-c77d09e183fa.filesusr.com
• b220e211-7334-4852-a8ab-5c67d0fa89aa.filesusr.com
• 75d7c3e4-dfa8-4198-aa6f-b23fd97d1a17.filesusr.com
• 5959f75f-ce17-405c-971a-94e16ddb9b77.filesusr.com
• c20604e6-355e-4a9a-9367-a631e79b6230.filesusr.com
• 22d4760d-0511-4e42-a791-fdff23529de6.filesusr.com
• 1ef64aaf-114e-41dd-9822-71e92ba46f13.filesusr.com
• files.hannahsclassroom.com
• bizobap.ckuniquedesigns.com
• 054bb1ca-f808-11ea-a328-fc4dd43d38a6.filesusr.com
• 8c436923-5f12-463f-a08e-2b2a6cb99ebe.filesusr.com
• 9c6f0df0-4918-4220-8be5-d4b8cc3b20b6.filesusr.com
• 717c7084-f980-4879-ae32-067e94814490.filesusr.com
• 3d8d954d-e23b-4049-a597-531d0ba7570a.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report