MALICIOUS — b42fd6_9dfd53c295b74723a2e0aad6b25bc92d.pdf

MALICIOUS — b42fd6_9dfd53c295b74723a2e0aad6b25bc92d.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: beb2e103d7baf44debb0e032c79bcd6407372966c324ef1869794de2ba4a7f91
• SHA-1: 61923de0a649df1fe269fecdf575ac95c8e0b3cf
• MD5: 5f599894424a699a77044e6af470fc34
• ssdeep: 768:tgGzpD3SxbxgJtYtLe6/aeDpgQzl+VmFbC311CMBQEuW8cE5:OGF7zYtLN1DpgQxPFbC3LCEQEuzcE5
• TLSH: T192338EF35193DC8C7687AF136C9A249A6046C78C61376764A8AC736CC6FC2AD7E52430
• Submitted as: b42fd6_9dfd53c295b74723a2e0aad6b25bc92d.pdf
• File type: pdf · Size: 48234 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.ru/wix?keyword=1.1.5a+circuit+theory+answers, https://cb10fa2e-44d5-4bef-971d-f8cb8f8c4656.filesusr.com/ugd/60e703_9f453d161862420390b715b585d96cd8.pdf?index=true, https://b82ce8e7-cea8-40bc-97ab-3bf88e35d86b.filesusr.com/ugd/0af078_2067d8f125944e84974a7d3a139457fa.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.ru/wix?keyword=1.1.5a+circuit+theory+answers
• https://cb10fa2e-44d5-4bef-971d-f8cb8f8c4656.filesusr.com/ugd/60e703_9f453d161862420390b715b585d96cd8.pdf?index=true
• https://b82ce8e7-cea8-40bc-97ab-3bf88e35d86b.filesusr.com/ugd/0af078_2067d8f125944e84974a7d3a139457fa.pdf?index=true
• https://2e2dfa89-35c1-43ae-8ace-2a8a6ddd3c93.filesusr.com/ugd/dad7b5_ed0755543443499b926961a5f26e82aa.pdf?index=true
• https://e7f86a52-fd28-4ef6-a524-51fcc1477038.filesusr.com/ugd/911c12_16d83cff63f941588e1ee134bdde40b3.pdf?index=true
• http://sekogaxu.leisuretravelsrilanka.com/uploads/1/3/1/4/131407406/5769086.pdf
• http://bigubula.bradbstevens.com/uploads/1/3/1/8/131857241/bb29f0dadcf0a7c.pdf
• http://files.benbrixey.com/uploads/1/3/0/7/130738548/fabuberovipi.pdf
• http://files.saltlakefencecompany.com/uploads/1/3/2/3/132303219/1731994.pdf
• https://46bed328-3fc9-4e75-8fe1-233c4b0605aa.filesusr.com/ugd/e2b09b_3b90ae82f8734f0c9bf67e6b732fa304.pdf?index=true
• https://bad08d10-9daa-4bc1-9a8f-7d71fca25cb1.filesusr.com/ugd/dcc11b_ecbeefca44e043b3a2c943de325dc517.pdf?index=true
• https://22ae9a70-d667-4390-a095-b7cb149e5858.filesusr.com/ugd/64bd79_de73594fe7ca4383a0ad9aecf1163653.pdf?index=true
• https://fa089e13-cc6c-47b1-8142-d3c158368540.filesusr.com/ugd/bba345_252f44acc165494d95cac258084ecd0b.pdf?index=true
• https://ba5193fc-aea4-468c-a0a0-eb0d8276c3ea.filesusr.com/ugd/d7d6cd_40567d8cb3bd41de8742ff6ac0697796.pdf?index=true
• https://cdn.shopify.com/s/files/1/0434/8539/7152/files/komatugi.pdf
• https://cdn.shopify.com/s/files/1/0444/3960/1318/files/warning_sign_template_free.pdf
• https://cdn.shopify.com/s/files/1/0430/7930/3317/files/73324945336.pdf
• https://cdn.shopify.com/s/files/1/0430/3598/4029/files/teachers_day_quotes_in_english.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.ru
• cb10fa2e-44d5-4bef-971d-f8cb8f8c4656.filesusr.com
• b82ce8e7-cea8-40bc-97ab-3bf88e35d86b.filesusr.com
• 2e2dfa89-35c1-43ae-8ace-2a8a6ddd3c93.filesusr.com
• e7f86a52-fd28-4ef6-a524-51fcc1477038.filesusr.com
• sekogaxu.leisuretravelsrilanka.com
• bigubula.bradbstevens.com
• files.benbrixey.com
• files.saltlakefencecompany.com
• 46bed328-3fc9-4e75-8fe1-233c4b0605aa.filesusr.com
• bad08d10-9daa-4bc1-9a8f-7d71fca25cb1.filesusr.com
• 22ae9a70-d667-4390-a095-b7cb149e5858.filesusr.com
• fa089e13-cc6c-47b1-8142-d3c158368540.filesusr.com
• ba5193fc-aea4-468c-a0a0-eb0d8276c3ea.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report