MALICIOUS — 7756869003.pdf

MALICIOUS — 7756869003.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 52 detection engines flagged it.

Identification

• SHA-256: bf01fed5a8796f65ef3a7eb0ba2dc986abb6e99a9d4926431159add41dada720
• SHA-1: 5eb937198eb2cd3e30cbda0f6f0764cbe8384f50
• MD5: 530935af329525404a3dc210e15c37d6
• ssdeep: 1536:xGF9krlXoveVW1nB8Np+jsW4U4RWLcqD7:UF9krlUOenB8Np+jd4RWLca
• TLSH: T19A34CFF35157DCCC7689AB07B9F6008AA199D7886123A6F059C8362CD4BC6FD3F10A61
• Submitted as: 7756869003.pdf
• File type: pdf · Size: 56559 bytes
• Verdict: malicious (88/100)

Detections (3 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://gettraff.ru/strik?keyword=classification+of+matter+webquest+part+1+answers, https://cdn.shopify.com/s/files/1/0266/9199/3791/files/rekovosumemagezisikurimi.pdf, https://cdn.shopify.com/s/files/1/0434/0105/2321/files/asus_t100taf-b11-gr_drivers.pdf - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://gettraff.ru/strik?keyword=classification+of+matter+webquest+part+1+answers
• https://cdn.shopify.com/s/files/1/0266/9199/3791/files/rekovosumemagezisikurimi.pdf
• https://cdn.shopify.com/s/files/1/0434/0105/2321/files/asus_t100taf-b11-gr_drivers.pdf
• https://cdn.shopify.com/s/files/1/0479/3827/3447/files/vanagon_westfalia_repair_manual.pdf
• https://cdn.shopify.com/s/files/1/0487/0474/9718/files/beer_bottle_sizes_uk.pdf
• https://cdn.shopify.com/s/files/1/0434/1081/7180/files/hyper_spinfit_700c_inner_tube_size.pdf
• https://uploads.strikinglycdn.com/files/6f7911a5-21f9-4322-b064-97baea700873/kevotivotuseputimozedivu.pdf
• http://savevelu.cailliemutterback.com/uploads/1/3/1/0/131070197/fufosaniwolo.pdf
• http://files.centralstockcare.com/uploads/1/3/1/6/131637137/7f1191d1ca5.pdf
• https://cdn.shopify.com/s/files/1/0430/3329/7058/files/multiplying_and_dividing_rational_expressions_worksheet_kuta_algebra_2.pdf
• https://cdn.shopify.com/s/files/1/0427/5775/0951/files/george_washington_timeline_worksheet.pdf
• https://cdn.shopify.com/s/files/1/0437/5301/3409/files/oriental_adventures_modules.pdf
• https://cdn.shopify.com/s/files/1/0482/8181/3156/files/diluwetiler.pdf
• https://cdn.shopify.com/s/files/1/0478/3718/4159/files/71861580460.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• gettraff.ru
• cdn.shopify.com
• uploads.strikinglycdn.com
• savevelu.cailliemutterback.com
• files.centralstockcare.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report