MALICIOUS — f08e01_7066aad4ff574682a27e18d1a17d2234.pdf

MALICIOUS — f08e01_7066aad4ff574682a27e18d1a17d2234.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: b8a438ceff28a0d9d186f71a75a5fdd1538f5513b9af17b849a907d10741985a
• SHA-1: c12cbf781ae6df8a01d3530a81eaf08c6143366a
• MD5: 7005b5a50075b517b70115ec2897e6c7
• ssdeep: 768:BgGzpD6ItSxUhOQi6FPa9KdPP0SnRfr+MWQ7kyTuf5CGOq:yGFm9jQi6w90PBj+MWqDuf5CGOq
• TLSH: T124317DF310A7DC8C3BCBAB43ADAB119C7446D6896132D66045D97B6CC4BC6BD6F009A0
• Submitted as: f08e01_7066aad4ff574682a27e18d1a17d2234.pdf
• File type: pdf · Size: 41570 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.me/wix?keyword=manual+de+lo+prohibido+raul+ornelas, https://73ae0315-188d-4244-8b59-153900ab6d91.filesusr.com/ugd/b463f2_28e5663a4e034dc39d952fd66d051664.pdf?index=true, https://c55a8e8e-f659-4972-acee-02f43e91aa68.filesusr.com/ugd/0b46e6_31a11b04b5b647299fc54ae7bb2987a3.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.me/wix?keyword=manual+de+lo+prohibido+raul+ornelas
• https://73ae0315-188d-4244-8b59-153900ab6d91.filesusr.com/ugd/b463f2_28e5663a4e034dc39d952fd66d051664.pdf?index=true
• https://c55a8e8e-f659-4972-acee-02f43e91aa68.filesusr.com/ugd/0b46e6_31a11b04b5b647299fc54ae7bb2987a3.pdf?index=true
• https://e44c3155-bca1-4daa-ab8a-460573827c12.filesusr.com/ugd/58a813_970dad472a4e47d593e0db25c6010caa.pdf?index=true
• https://25b0d0ae-071f-47cd-9bda-c09342683576.filesusr.com/ugd/89064d_6d336c291d2d4778b814a2e6e45387cb.pdf?index=true
• http://rasofira.mcintireinteriordesign.com/uploads/1/3/0/9/130969360/a06cc536.pdf
• http://files.violinfriends.com/uploads/1/3/1/8/131871907/firagusitamodid-ditudigirixikiw.pdf
• http://files.valordnorwegianelkhounds.com/uploads/1/3/0/7/130739444/7171999.pdf
• http://files.martin-hickman.com/uploads/1/3/1/4/131438059/1698709.pdf
• https://40429b4b-d855-4b32-aa6b-cea0adbafd6d.filesusr.com/ugd/5bb01c_536037b408f84525b7b23cb12ad997e0.pdf?index=true
• https://8cf9f28e-b1c2-47d0-86c8-09043c81b9eb.filesusr.com/ugd/359e64_3de3f0c13035479da6faa3c442959f5f.pdf?index=true
• https://09a65186-d67b-4bee-b5a4-b11934712c3c.filesusr.com/ugd/296484_ed90a922690d463bb118378179c5450c.pdf?index=true
• https://046271e0-5544-4b74-9052-808681b28479.filesusr.com/ugd/2994dd_d82977ef085c4c598a4996df0858ba6f.pdf?index=true
• https://02994391-4047-4f10-b93f-7edb5d6e73d9.filesusr.com/ugd/37987b_8b3f4fa1b9db4c82a3458c613ed36cce.pdf?index=true
• https://37cd0a03-e4c6-4b86-9322-43ff1f1f42bc.filesusr.com/ugd/610d21_3b4347a0118a4a07a8b9cfba13a6af45.pdf?index=true
• https://8c2925b9-f09c-420d-ad2d-a2760fcb934b.filesusr.com/ugd/0af078_b8213348f7914b958a9b2f6ab636000a.pdf?index=true
• https://25da1cd9-757e-43ee-9329-40fe05072c31.filesusr.com/ugd/33ab24_cfd4aa60e50b4f3d9ebfbf6db5726e6a.pdf?index=true
• https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.me
• 73ae0315-188d-4244-8b59-153900ab6d91.filesusr.com
• c55a8e8e-f659-4972-acee-02f43e91aa68.filesusr.com
• e44c3155-bca1-4daa-ab8a-460573827c12.filesusr.com
• 25b0d0ae-071f-47cd-9bda-c09342683576.filesusr.com
• rasofira.mcintireinteriordesign.com
• files.violinfriends.com
• files.valordnorwegianelkhounds.com
• files.martin-hickman.com
• 40429b4b-d855-4b32-aa6b-cea0adbafd6d.filesusr.com
• 8cf9f28e-b1c2-47d0-86c8-09043c81b9eb.filesusr.com
• 09a65186-d67b-4bee-b5a4-b11934712c3c.filesusr.com
• 046271e0-5544-4b74-9052-808681b28479.filesusr.com
• 02994391-4047-4f10-b93f-7edb5d6e73d9.filesusr.com
• 37cd0a03-e4c6-4b86-9322-43ff1f1f42bc.filesusr.com
• 8c2925b9-f09c-420d-ad2d-a2760fcb934b.filesusr.com
• 25da1cd9-757e-43ee-9329-40fe05072c31.filesusr.com
• 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report