MALICIOUS — b81754_9afcde19280549ecbaa6bf140aedfced.pdf

MALICIOUS — b81754_9afcde19280549ecbaa6bf140aedfced.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: ac9e3717d3887a0bf265f85702592bd052c5d7bc021507f15a2a47af24e3049f
• SHA-1: 1a3177874634faba07f8bfc3830d6988291814b9
• MD5: 89599e316de0cbf9b202fe80f75fd003
• ssdeep: 768:ZgGzpDEVHkAR3fRXcrmhGanwtZlX+hr4hFRVg9lVNIgJNsz1EtPhGhd0L:aGFgZwvt+ZSl6NRNszCshd0L
• TLSH: T1E034AEF324C3ED8C6A976F476EEA149E5186DB8C2123977014C87A2CD87C2FD6E10A51
• Submitted as: b81754_9afcde19280549ecbaa6bf140aedfced.pdf
• File type: pdf · Size: 52416 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=longstreet+tv+series+dvd, http://sojoneki.kwdrivefamily.com/uploads/1/3/0/7/130739173/3642679.pdf, http://files.nourishe.co.nz/uploads/1/3/0/9/130968921/8d6432e4ac.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=longstreet+tv+series+dvd
• http://sojoneki.kwdrivefamily.com/uploads/1/3/0/7/130739173/3642679.pdf
• http://files.nourishe.co.nz/uploads/1/3/0/9/130968921/8d6432e4ac.pdf
• http://files.twobitranchphotography.com/uploads/1/3/2/3/132302999/1621a771.pdf
• http://pujarim.timothyalexandrewallace.com/uploads/1/3/0/7/130776225/542bd114c40d.pdf
• http://lolewe.rockinghamsixties.com/uploads/1/3/1/4/131438216/202428.pdf
• https://b430f669-6cea-4c62-bfb2-5c022bffbc31.filesusr.com/ugd/95089d_541034c6934f4d128fdfae76505a22e7.pdf?index=true
• https://6d81ce6b-ddfa-4a24-8c0f-6b3132c99ddf.filesusr.com/ugd/7ad284_702695ef07c94d8e8f4bb7552a126d27.pdf?index=true
• https://ba44754d-92ae-46a2-be9e-2d534ab990d9.filesusr.com/ugd/c83fdb_14fe707f964e4124b8fa109dbcaaf301.pdf?index=true
• https://445dcb2e-18b1-4806-9cc3-56a473b492a2.filesusr.com/ugd/8da65f_236f9fb505cd45bea573b9d4a3133e30.pdf?index=true
• https://ec8d66cd-493c-4cde-875a-44e26b5db311.filesusr.com/ugd/65b209_fa9f02e1022f4aa1a95b65eee92564b7.pdf?index=true
• https://76240503-bba4-4b53-81c0-e198561a6b5f.filesusr.com/ugd/70e5f7_ef14b8361ff94421aa07db5070ef47ae.pdf?index=true
• https://cdn.shopify.com/s/files/1/0437/1444/5465/files/ccie_security_questions.pdf
• https://cdn.shopify.com/s/files/1/0428/3380/5471/files/wamaj.pdf
• https://cdn.shopify.com/s/files/1/0439/0843/2027/files/56035403441.pdf
• https://cdn.shopify.com/s/files/1/0431/1531/5349/files/counter_strike_2018_free_for_pc.pdf
• https://cdn.shopify.com/s/files/1/0429/7755/8681/files/15167340705.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• sojoneki.kwdrivefamily.com
• files.twobitranchphotography.com
• pujarim.timothyalexandrewallace.com
• lolewe.rockinghamsixties.com
• b430f669-6cea-4c62-bfb2-5c022bffbc31.filesusr.com
• 6d81ce6b-ddfa-4a24-8c0f-6b3132c99ddf.filesusr.com
• ba44754d-92ae-46a2-be9e-2d534ab990d9.filesusr.com
• 445dcb2e-18b1-4806-9cc3-56a473b492a2.filesusr.com
• ec8d66cd-493c-4cde-875a-44e26b5db311.filesusr.com
• 76240503-bba4-4b53-81c0-e198561a6b5f.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com
• files.nourishe.co.nz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report