MALICIOUS — b916f4_a6e4bbfd0ff44f49aca03e7543ca1502.pdf

MALICIOUS — b916f4_a6e4bbfd0ff44f49aca03e7543ca1502.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: b1d2deb5f4b9fb8b34f00c25566f771042e132eb9f03bab16ddaae9ffbdf993d
• SHA-1: f91854111b072b60bc922b7cc9c4723553287c96
• MD5: 55003198839cdc0789334812fd6537a7
• ssdeep: 768:VgGzpDQ0IlIvPjvr2dcNE3GM19mGQn609YGlBjfmzQh42FETujncr:GGF8f42Rwn609YGrLuujncr
• TLSH: T1DD329EF34097ED8C7A8B9F437EEB20496186D6896133966004DC7B6CC0BC9ED6E10975
• Submitted as: b916f4_a6e4bbfd0ff44f49aca03e7543ca1502.pdf
• File type: pdf · Size: 43852 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.PDF.Agent.gen

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.PDF.Agent.gen (rule HEUR:Trojan.PDF.Agent.gen) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=inspector+training+manual, http://lajebuleg.everettqualitylandscaping.com/uploads/1/3/2/7/132740214/vekoxituxeno.pdf, http://files.listprogramme.com/uploads/1/3/1/3/131380126/4734388.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=inspector+training+manual
• http://lajebuleg.everettqualitylandscaping.com/uploads/1/3/2/7/132740214/vekoxituxeno.pdf
• http://files.listprogramme.com/uploads/1/3/1/3/131380126/4734388.pdf
• http://mikan.calgaryclothdiaperdepot.com/uploads/1/3/2/3/132303181/lupatamukupapix.pdf
• https://410fdd8e-75a6-42ac-ac10-320e8f664462.filesusr.com/ugd/a2de88_2f9f05a8550e475ab2f3d4230e0f1961.pdf?index=true
• https://bd2fdb06-3ae2-450d-aed9-4f69844269bc.filesusr.com/ugd/f3cb45_49c4478e83804dedabc803ed1b97c306.pdf?index=true
• https://1a98af38-2636-487a-9bec-260ebc7bfda8.filesusr.com/ugd/067ecb_db32d3b3fe8c4e36aedd821549f35750.pdf?index=true
• https://cf22f4f4-0b20-44f1-80f7-20d8885a34b8.filesusr.com/ugd/3f80ec_d4dc942ed53c4463bd15b069d3c6ca3d.pdf?index=true
• https://90b2b549-350c-41c7-9e14-8aab2d6db6c0.filesusr.com/ugd/d43733_46c0b7e84a15457799cb6b3e31f53d77.pdf?index=true
• https://cdn.shopify.com/s/files/1/0431/0079/9140/files/class_10_math_notes_download.pdf
• https://cdn.shopify.com/s/files/1/0429/8473/4883/files/towafepumiripotivixabal.pdf
• https://cdn.shopify.com/s/files/1/0432/0477/1999/files/hypertrophic_cardiomyopathy_guideline.pdf
• https://cdn.shopify.com/s/files/1/0430/8844/5604/files/very_hungry_caterpillar_printable_coloring_sheets.pdf
• https://9bf21523-2b72-4cc9-82f7-dfb1b55212c6.filesusr.com/ugd/3be48b_dac5b590fc7a4e46bcdb17347d906755.pdf?index=true
• https://a1c5989d-9efe-41a2-868f-f2e620ec91d5.filesusr.com/ugd/dfb5f8_092aae4d25d0493aa963416f94c0d6ca.pdf?index=true
• https://dc9e219a-536d-4674-91e3-1b74611da7ea.filesusr.com/ugd/f35da0_b7768a70b87e4645888501d1a11ca9a6.pdf?index=true
• https://31aa4a2a-46c3-4c8a-9336-0c236ae27b6e.filesusr.com/ugd/eb4c03_376a283a53ae4cdba68a831465812080.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• lajebuleg.everettqualitylandscaping.com
• files.listprogramme.com
• mikan.calgaryclothdiaperdepot.com
• 410fdd8e-75a6-42ac-ac10-320e8f664462.filesusr.com
• bd2fdb06-3ae2-450d-aed9-4f69844269bc.filesusr.com
• 1a98af38-2636-487a-9bec-260ebc7bfda8.filesusr.com
• cf22f4f4-0b20-44f1-80f7-20d8885a34b8.filesusr.com
• 90b2b549-350c-41c7-9e14-8aab2d6db6c0.filesusr.com
• cdn.shopify.com
• 9bf21523-2b72-4cc9-82f7-dfb1b55212c6.filesusr.com
• a1c5989d-9efe-41a2-868f-f2e620ec91d5.filesusr.com
• dc9e219a-536d-4674-91e3-1b74611da7ea.filesusr.com
• 31aa4a2a-46c3-4c8a-9336-0c236ae27b6e.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report