MALICIOUS — 9c66ff_6a042f79fe464025adfbecd81895104d.pdf

MALICIOUS — 9c66ff_6a042f79fe464025adfbecd81895104d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: b6fc825bcfc34e1cbfb6b808ea23544bf085a13da446ce4d7f07848d23c08b09
• SHA-1: ed0345704258523ee094f5b4d5a01ea911244051
• MD5: efc06b362b371c87aa6b8a2fc18e54cf
• ssdeep: 768:mgGzpDVwj6zMvvdFFiltp01BB9aEKmsGgDb3T2sBc3:zGFRwguQLVGg/j2sBc3
• TLSH: T19C31BEF39097ED883BCB5717AAAA01596049D68D7033876049CC772CCAB86FD6F50922
• Submitted as: 9c66ff_6a042f79fe464025adfbecd81895104d.pdf
• File type: pdf · Size: 42596 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=physics+of+the+impossible+pdf+bangla, http://files.artbyaiste.com/uploads/1/3/0/8/130813965/jakizabiru.pdf, http://files.smokestopvapes.com/uploads/1/3/1/6/131606487/namurimulagen_buvajexolovewob.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=physics+of+the+impossible+pdf+bangla
• http://files.artbyaiste.com/uploads/1/3/0/8/130813965/jakizabiru.pdf
• http://files.smokestopvapes.com/uploads/1/3/1/6/131606487/namurimulagen_buvajexolovewob.pdf
• http://widajufi.depthstiny.com/uploads/1/3/0/8/130814579/jajuvabegojenoj.pdf
• https://cdn.shopify.com/s/files/1/0431/8773/2644/files/momijupulopexezamazeze.pdf
• https://cdn.shopify.com/s/files/1/0427/9074/8316/files/lijeleped.pdf
• https://cdn.shopify.com/s/files/1/0431/4365/9677/files/ssc_blank_answer_sheet.pdf
• https://cdn.shopify.com/s/files/1/0428/9835/8432/files/37237973095.pdf
• https://cdn.shopify.com/s/files/1/0432/5667/6507/files/39769862412.pdf
• https://cb6dea7f-6d99-4d07-aa42-7f7eb2e4e046.filesusr.com/ugd/c1108c_208f070f04a344b89d1d17671c6b3d66.pdf?index=true
• https://892317e5-077a-4b1c-865e-561a529bee49.filesusr.com/ugd/0cd3a8_51fd099630c1482c9fa473635b64e673.pdf?index=true
• https://01c17690-58bd-4bbf-b930-de088c418deb.filesusr.com/ugd/0ebc1f_b7c15d2d1ea44873980cb1ba0780b01e.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• files.artbyaiste.com
• files.smokestopvapes.com
• widajufi.depthstiny.com
• cdn.shopify.com
• cb6dea7f-6d99-4d07-aa42-7f7eb2e4e046.filesusr.com
• 892317e5-077a-4b1c-865e-561a529bee49.filesusr.com
• 01c17690-58bd-4bbf-b930-de088c418deb.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report