MALICIOUS — d2cc1f_d05de9caa25d41a28b4eb7f27a45e301.pdf
MALICIOUS — d2cc1f_d05de9caa25d41a28b4eb7f27a45e301.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
b3bb91983dae431031e1aeb7c98da80407c938430ffea081b4638b812236fc2c - SHA-1:
f3e587f494c4b01c3dc66ff5700e0b58e892d4f2 - MD5:
0f8a0a687de379adb227c6efa3e35fdc - ssdeep:
768:NgGzpDRXJR9qZ52kjYSn525zpwF40csvmpmDRiJcUAQj8bOnT77wi:uGF1G7cp84dsepmtkZAQgbOn7wi - TLSH:
T14F32BFF314ABDC8C5AC6AB036EA721552486D78D60329B6459C97F7CC4BC5FCAE40930 - Submitted as: d2cc1f_d05de9caa25d41a28b4eb7f27a45e301.pdf
- File type: pdf · Size: 47505 bytes
- Verdict: malicious (88/100)
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Kaspersky (KVRT): HEUR:Trojan.Script.Generic
Why this verdict
The malicious score of 88/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule
HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.cc/wix?keyword=my+big+toe+pdf+download+free, https://ffc62988-6def-41ed-9e56-8b26cc4a3500.filesusr.com/ugd/3225da_4c6fde3126bf45c6b3f17e3b18471d38.pdf?index=true, https://be4f2425-d8cd-428e-aad1-a681a1d7f962.filesusr.com/ugd/4c1554_758da3dd5258437d8720a058860512b9.pdf?index=true - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.cc/wix?keyword=my+big+toe+pdf+download+free
- https://ffc62988-6def-41ed-9e56-8b26cc4a3500.filesusr.com/ugd/3225da_4c6fde3126bf45c6b3f17e3b18471d38.pdf?index=true
- https://be4f2425-d8cd-428e-aad1-a681a1d7f962.filesusr.com/ugd/4c1554_758da3dd5258437d8720a058860512b9.pdf?index=true
- https://7133ca88-2559-495b-af0c-7a7bb9c43431.filesusr.com/ugd/1cc7e8_e16b4e7b487c4806bfac12348a94bc98.pdf?index=true
- http://files.allwellbreaksloose.com/uploads/1/3/0/7/130776791/1956015.pdf
- https://660062cf-c019-4606-b502-78790cced978.filesusr.com/ugd/dec231_10849f5fa66b43dd84a41b02aa1d05ef.pdf?index=true
- https://5597544f-3ffa-4fd3-86a8-db190634bebc.filesusr.com/ugd/2d1648_e84a1f67a62249138570195f76f16f01.pdf?index=true
- https://266090ff-a053-42e4-a15a-d83395ba3d3f.filesusr.com/ugd/fe83c3_b9965e83d790445fba30e9d45a5cf388.pdf?index=true
- https://cdn.shopify.com/s/files/1/0457/3783/6710/files/consecuencias_militares_de_las_reformas_borbonicas.pdf
- https://cdn.shopify.com/s/files/1/0427/4572/5094/files/aium_guidelines_for_abdominal_ultrasound.pdf
- https://cdn.shopify.com/s/files/1/0432/7935/1968/files/pejum.pdf
- https://cdn.shopify.com/s/files/1/0433/5278/5055/files/67490917908.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.cc
- ffc62988-6def-41ed-9e56-8b26cc4a3500.filesusr.com
- be4f2425-d8cd-428e-aad1-a681a1d7f962.filesusr.com
- 7133ca88-2559-495b-af0c-7a7bb9c43431.filesusr.com
- files.allwellbreaksloose.com
- 660062cf-c019-4606-b502-78790cced978.filesusr.com
- 5597544f-3ffa-4fd3-86a8-db190634bebc.filesusr.com
- 266090ff-a053-42e4-a15a-d83395ba3d3f.filesusr.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report