MALICIOUS — d7d6cd_9fc16d291cdb461c9ceb18c2b82cb8da.pdf

MALICIOUS — d7d6cd_9fc16d291cdb461c9ceb18c2b82cb8da.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: b5ad01b5db7fd170e06bd41b8d90717db51e270e51e35ac907d516c032e56278
• SHA-1: e0f461065866d00ea8f17fce717c9740c503e5e0
• MD5: b135132d92488ad92d8c0331e70ece72
• ssdeep: 768:6gGzpD3+x3ptyz0Wni2FikHbCia3RRljmzdq4Gmvd:nGFj+QRTskH+FFmBq4Gmvd
• TLSH: T111307EF3A097DC8C7AC79F076EAA155DA046D7886162A77048D8762DC4BC2BE7F40930
• Submitted as: d7d6cd_9fc16d291cdb461c9ceb18c2b82cb8da.pdf
• File type: pdf · Size: 37007 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=super+mario+64+rom+extender+1.3b, http://files.karynpearson.ca/uploads/1/3/2/6/132696128/senakojadukela_mixusesepib_rogobotenes.pdf, http://files.apsimarin.com/uploads/1/3/1/6/131637385/5a0f42adcc3ee.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=super+mario+64+rom+extender+1.3b
• http://files.karynpearson.ca/uploads/1/3/2/6/132696128/senakojadukela_mixusesepib_rogobotenes.pdf
• http://files.apsimarin.com/uploads/1/3/1/6/131637385/5a0f42adcc3ee.pdf
• http://files.brewsterwhitecaps.com/uploads/1/3/2/7/132710795/88ff3.pdf
• https://b2216816-d40e-4e80-974f-f1ba2cd2bca5.filesusr.com/ugd/9904c2_727b7a26255b46a3bcaeba616e9d9325.pdf?index=true
• https://ea7f6f7b-ee76-4982-9ac8-70fca99af599.filesusr.com/ugd/96564c_ae73b14d109a47a0bfc81efd33e7e8dd.pdf?index=true
• https://9ecdbaa8-601d-446f-b86a-c54c238395b8.filesusr.com/ugd/d8966e_82938862ddf14b2d8351dbb0580b256b.pdf?index=true
• http://xipajoko.brigetteburns.com/uploads/1/3/1/3/131384201/ee000cdaa13.pdf
• http://files.historicinterpretations.org/uploads/1/3/1/4/131483830/4777713.pdf
• http://vakonow.doublejoutfittersny.com/uploads/1/3/1/6/131606271/2717341.pdf
• http://rosuj.the-learning-agency-lab.com/uploads/1/3/0/8/130874019/6429285.pdf
• http://redom.ipksportsbetting.com/uploads/1/3/1/8/131857252/xulubafude_fowiwu_sowelorujigeb_kamagigo.pdf
• https://7243fa44-44db-4f08-93dd-b245805a140e.filesusr.com/ugd/de60da_6dd7ad7c26b7483ba3cd5b5506ff020d.pdf?index=true
• https://eda2654f-f331-4251-8eb0-a5f41eb15e7e.filesusr.com/ugd/154db6_d4a23dd5f39e43c39d2b2fa05dec8a5a.pdf?index=true
• https://e91157f5-cc7b-479b-becc-e92433be3ef7.filesusr.com/ugd/c8683e_8726eb9ddc724ac68b01570f072c90cf.pdf?index=true
• https://34514eba-0368-4782-9fd6-1fe4700e94a1.filesusr.com/ugd/9e14ca_e370d27f09e242f6bb6e8858a1a46e60.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• files.karynpearson.ca
• files.apsimarin.com
• files.brewsterwhitecaps.com
• b2216816-d40e-4e80-974f-f1ba2cd2bca5.filesusr.com
• ea7f6f7b-ee76-4982-9ac8-70fca99af599.filesusr.com
• 9ecdbaa8-601d-446f-b86a-c54c238395b8.filesusr.com
• xipajoko.brigetteburns.com
• files.historicinterpretations.org
• vakonow.doublejoutfittersny.com
• rosuj.the-learning-agency-lab.com
• redom.ipksportsbetting.com
• 7243fa44-44db-4f08-93dd-b245805a140e.filesusr.com
• eda2654f-f331-4251-8eb0-a5f41eb15e7e.filesusr.com
• e91157f5-cc7b-479b-becc-e92433be3ef7.filesusr.com
• 34514eba-0368-4782-9fd6-1fe4700e94a1.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report