MALICIOUS — 33ab24_924de9c6e5e446808e0a859bb0e8d2b7.pdf

MALICIOUS — 33ab24_924de9c6e5e446808e0a859bb0e8d2b7.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: bf36abd1f6f9d4a4de36d16ace7b55cd50b4664cc70fa72b591cb4d9bf79c0d7
• SHA-1: 2594621e434b9627539e78cea7df0c73f9eb122c
• MD5: 13caa29df2b104a44876c29fd2928fbe
• ssdeep: 768:FgGzpDxAfHzSV19XWkFLaD6EFamyLn1CAdSh3bJ2GaofyFjovNYw2pfNItaW3/yT:WGFtWWVGgau2hrJ2dS2xNdcIuS+O
• TLSH: T18136D0F341C7ED497A471F07A9EA142A6012D9897172A7A465C83B3CC87C2BC6F50E72
• Submitted as: 33ab24_924de9c6e5e446808e0a859bb0e8d2b7.pdf
• File type: pdf · Size: 64437 bytes
• Verdict: malicious (88/100)

Detections (3 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Script.Generic (rule HEUR:Trojan.Script.Generic) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.cc/wix?keyword=mro+worksheet+duty+preferences, https://01dbf5a0-6041-49b2-b7b1-6dc0f12b3335.filesusr.com/ugd/dcf9ad_5bb9d7224d174eca9e7b7c3aa65d0898.pdf?index=true, https://5f475c2c-92ad-4e99-8246-6741821c5aeb.filesusr.com/ugd/5bb01c_e34f2da5f8164d61998e9f1da01c004b.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.cc/wix?keyword=mro+worksheet+duty+preferences
• https://01dbf5a0-6041-49b2-b7b1-6dc0f12b3335.filesusr.com/ugd/dcf9ad_5bb9d7224d174eca9e7b7c3aa65d0898.pdf?index=true
• https://5f475c2c-92ad-4e99-8246-6741821c5aeb.filesusr.com/ugd/5bb01c_e34f2da5f8164d61998e9f1da01c004b.pdf?index=true
• https://05d9e9bd-849c-4b34-88d7-c86bdd26ece3.filesusr.com/ugd/e948c1_4ea34beae228496386706beb74273769.pdf?index=true
• https://812bca8f-8894-4a7e-85eb-d7dcde6a3015.filesusr.com/ugd/c57cae_788cce77602d447881ffef8b5cba5129.pdf?index=true
• http://files.lovehanoi.org/uploads/1/3/1/8/131856277/vanedujanex.pdf
• https://9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com/ugd/3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf?index=true
• https://479e97e2-b005-4d03-9a4c-3ed510d2c1ab.filesusr.com/ugd/9df9d6_c764321f4b72419ba7e81ff15ae8197e.pdf?index=true
• https://f4d72857-9808-44eb-971d-967bc272c079.filesusr.com/ugd/7a13df_8423c8ada10f40a99b863f34c8737fd5.pdf?index=true
• https://cdn.shopify.com/s/files/1/0435/5876/4696/files/bay_leaf_benefits.pdf
• https://cdn.shopify.com/s/files/1/0430/4856/6933/files/20079144664.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.cc
• 01dbf5a0-6041-49b2-b7b1-6dc0f12b3335.filesusr.com
• 5f475c2c-92ad-4e99-8246-6741821c5aeb.filesusr.com
• 05d9e9bd-849c-4b34-88d7-c86bdd26ece3.filesusr.com
• 812bca8f-8894-4a7e-85eb-d7dcde6a3015.filesusr.com
• files.lovehanoi.org
• 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com
• 479e97e2-b005-4d03-9a4c-3ed510d2c1ab.filesusr.com
• f4d72857-9808-44eb-971d-967bc272c079.filesusr.com
• cdn.shopify.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report